CVE-2024-42448: critical vulnerability in Veeam Service Provider Console
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It exploitation observed by VulnCheck, has an official Brazilian government alert and has a public proof of concept.
Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.
- CTIR Gov · ALERTA 30/2024Vulnerabilidade crítica no Veeam Service Provider Consoleread on gov.br ↗
A flaw in VSPC server allows an authorized management agent to execute arbitrary code remotely on the server machine. This is critical because it gives attackers complete control over the VSPC system if they compromise the management agent.
CWE-94 (Improper Control of Generation of Code) enables Remote Code Execution when an authenticated management agent communicates with the VSPC server. The vulnerability requires prior authorization of the management agent on the server; exploitation results in arbitrary code execution with server-level privileges.
In the same product, most dangerous first.