CVE-2024-29212criticalCWE-502

CVE-2024-29212: critical vulnerability in Veeam Service Provider Console

Published · Updated

Follow this CVE+ Monitor Service Provider Console

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.9epss 1.6%
In short

Veeam Service Provider Console has a critical flaw in how it processes data from its management components, allowing attackers to run malicious code directly on the server machine.

Technical detail

The vulnerability stems from unsafe deserialization (CWE-502) in VSPC server's inter-component communication protocol. Under specific conditions, an attacker with network access to the management agent channel can inject malicious serialized objects, leading to unauthenticated Remote Code Execution with server-level privileges.

Summary generated and translated by AI from the official description.
Due to an unsafe de-serialization method used by the Veeam Service Provider Console(VSPC) server in communication between the management agent and its components, under certain conditions, it is possible to perform Remote Code Execution (RCE) on the VSPC server machine.
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
Veeam · Service Provider Console
Related CVEs — Veeam Service Provider Console

In the same product, most dangerous first.

CVE-2024-42448CRITICALCVE-2024-42448EPSS 20.4%CVE-2024-42449HIGHCVE-2024-42449EPSS 6.0%CVE-2026-58072CRITICALCVE-2026-58072EPSS 0.5%CVE-2026-32998CRITICALCVE-2026-32998EPSS 0.5%CVE-2026-58067HIGHCVE-2026-58067EPSS 0.4%CVE-2026-58071HIGHCVE-2026-58071EPSS 0.4%