Veeam Backup Replication
CVE-2024-40714
HIGH
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
An improper certificate validation vulnerability in TLS certificate validation allows an attacker on the same network to intercept sensitive credentials during restore operations.
AnalysisAI
An improper certificate validation vulnerability in TLS certificate validation allows an attacker on the same network to intercept sensitive credentials during restore operations. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Technical ContextAI
This vulnerability is classified under CWE-295. An improper certificate validation vulnerability in TLS certificate validation allows an attacker on the same network to intercept sensitive credentials during restore operations. Affected products include: Veeam Veeam Backup \& Replication.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
More in Veeam Backup Replication
View allA deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code exec
VeeamFSR.sys in Veeam Availability Suite before 10 and Veeam Backup & Replication before 10 has no device object DACL, w
A second RCE vulnerability in Veeam Backup & Replication allows any authenticated domain user to execute code on the Bac
Veeam Backup & Replication allows an authenticated domain user to achieve remote code execution on the Backup Server. Wi
Yet another Veeam Backup & Replication RCE vulnerability allowing authenticated domain users to execute code on the Back
Veeam Backup Enterprise Manager allows unauthenticated users to log in as any user to enterprise manager web interface.
Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2). Rated critical severity (CVSS 9.8)
Veeam Backup and Replication 10 before 10.0.1.4854 P20210609 and 11 before 11.0.0.837 P20210507 mishandles deserializati
Veeam Backup & Replication allows Backup Administrators to achieve RCE in high-availability deployments. While requiring
Veeam allows Backup or Tape Operators to write files as root on the server. An operator-level role achieving root file w
Authenticated domain users can bypass file access restrictions on Backup Repository systems to read, modify, or delete a
A vulnerability in Veeam Backup & Replication platform allows a low-privileged user with a specific role to exploit a me
Same weakness CWE-295 – Improper Certificate Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today