9.8Crítica
KEV
Usada en ransomware
CVE-2024-40711Veeam Backup and Replication Deserialization Vulnerability
Explotación conocida — Veeam Backup and Replication Deserialization Vulnerability
CISA confirmó el 17.10.2024 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 07.11.2024.
Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. https://www.veeam.com/kb4649 ; https://nvd.nist.gov/vuln/detail/CVE-2024-40711
Descripción
A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).
Debilidad (CWE):
CWE-502
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| Veeam | Backup and Recovery | 12.1.2 – ≤ 12.1.2 | |
| veeam | backup_\&_replication | ≤ 12.2.0.334 | |
| veeam | veeam backup & replication | 12.0.0.1420 – < 12.2.0.334 |
Referencias y parches
- https://www.veeam.com/kb4649 Vendor Advisory
- https://labs.watchtowr.com/veeam-backup-response-rce-with-auth-but-mostly-without-auth-cve-2024-40711-2/ ExploitThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-40711 US Government Resource
Coincidencias CPE (NVD) (1)
cpe:2.3:a:veeam:veeam_backup_\&_replication:*:*:*:*:*:*:*:*≥ 12.0.0.1420 < 12.2.0.334