CVE-2024-40711criticalunder attackransomwareCWE-502

CVE-2024-40711: critical vulnerability in Veeam Backup and Recovery

Published · Updated

Follow this CVE+ Monitor Backup & Replication+ Monitor Backup and Recovery

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA, has a working public exploit and 1 threat group(s) use it.

ssvc Actcvss 9.8epss 90%
from disclosure to weapon8 days
Published on NVDSep 7
1st PoC+8d
CISA KEV+40d
Who exploits it — 1

Groups known to exploit this vulnerability (MITRE ATT&CK attribution).

Ransomwarefrag leak site
Action required by CISAfederal deadline: 2024-11-07

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

A vulnerability allows attackers to send specially crafted data to the application that gets processed unsafely, leading to arbitrary code execution on the server without needing any credentials. This is critical because attackers can take complete control of the affected system.

Technical detail

CWE-502 deserialization of untrusted data vulnerability enables unauthenticated remote attackers to execute arbitrary code by crafting malicious serialized objects. The vulnerability requires no authentication and allows complete system compromise; exploitation vectors depend on the application's deserialization entry points and available gadget chains.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Veeam · Backup and Recovery
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.