Multiple Veeam vulns spark concern among defenders

A series of vulnerabilities in products made by backup and recovery software supplier Veeam, which were disclosed and patched on 4 September 2024, are causing concern in the cyber security community.

The most critical issue revolves around a high-severity flaw fixed by Veeam, known as CVE-2024-40711, which is a remote code execution (RCE) vulnerability in Veeam Backup & Replication.

Discovered by researcher Florian Hauser of Code White, it has a critical CVSS score of 9.8. Code White has chosen not to disclose full technical details of the issue at this time to prevent potential exploitation.

The main worry currently is the potential threat posed by CVE-2024-40711. According to data from threat hunters at Censys, nearly 3,000 Veeam Backup & Replication servers are exposed on the public internet, with a majority in France and Germany.

“This vulnerability is particularly alarming as it is likely to be exploited by ransomware groups to compromise backup systems and possibly lead to double-extortion scenarios,” stated the Censys team.

Rapid7, which has been monitoring for signs of exploitation, has not detected any malicious activity related to CVE-2024-40711 as of Monday, 9 September.

However, Rapid7 cautioned that Veeam Backup & Replication has a wide deployment footprint, and past vulnerabilities in the software have been exploited by ransomware groups.

Rapid7’s data shows that over 20% of incident response cases this year have involved Veeam being accessed or exploited, typically after the attacker has gained access to the victim environment.

In addition to the critical CVE-2024-40711, five other vulnerabilities were disclosed in Backup & Replication, allowing attackers with low-privilege accounts to carry out malicious actions. These issues have been resolved in Backup & Replication 12.2 (build 12.2.0.334), and users are advised to apply the patches promptly.

Veeam has also released fixes for vulnerabilities in Veeam Agent for Linux, Veeam ONE, Veeam Service Provider Console, and Veeam Backup plugins for Nutanix AHV, Oracle Linux Virtualisation, and Red Hat Virtualisation.