CVE-2024-42449

—

CVSS 3.0

7.1 high

EPSS

6%p93

Published

Dec 4, 2024 (Dec 4, 2024)

Modified

Jun 17, 2026

Description

From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is possible to remove arbitrary files on the VSPC server machine.

Weakness: CWE-732
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

NVD CVE.org GitHub PoCs EPSS (5.8%)

In the news5 stories

Week in review: Veeam Service Provider Console flaws fixed, Patch Tuesday forecast

Help Net SecurityDec 8, 00:00 UTC · Dec 8, 2024Vulnerability CVE-2024-42448 CVE-2024-42449 CVE-2024-41713+1 CVEs

Veeam plugs serious holes in Service Provider Console (CVE-2024-42448, CVE-2024-42449)

Help Net SecurityDec 3, 00:00 UTC · Dec 3, 2024Vulnerability in the wildCVE-2024-42448 CVE-2024-42449

CVE-2024-42449

In the news5 stories

Week in review: Veeam Service Provider Console flaws fixed, Patch Tuesday forecast

Veeam Urges Immediate Update to Patch Severe Vulnerabilities

Veeam addressed critical Service Provider Console (VSPC) bug

Veeam Issues Patch for Critical RCE Vulnerability in Service Provider Console

Veeam plugs serious holes in Service Provider Console (CVE-2024-42448, CVE-2024-42449)