ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
The Hacker Newspublished ()ingested @TheHackersNews

New Veeam Flaw Allows Arbitrary Code Execution via Man-in-the

criticalVulnerabilityimportance 60CVE-2025-23114
Read the original
Tagscve-2025-23114vulnerability

Vulnerabilities mentionedAll →

CVEVulnerabilityCVSSEPSSFlagsAffectedExposurePublished
CVE-2025-23114
A vulnerability in Veeam Updater component allows Man-in-the-Middle attackers to execute arbitrary code on the affected server.

A vulnerability in Veeam Updater component allows Man-in-the-Middle attackers to execute arbitrary code on the affected server. This issue occurs due to a failure to properly validate TLS certificate.

NVD description · AI analysis pending		9.0<1%——
Full article325 words · extracted from thehackernews.com · click to collapse

Ravie LakshmananFeb 05, 2025Vulnerability / Data Protection

Veeam has released patches to address a critical security flaw impacting its Backup software that could allow an attacker to execute arbitrary code on susceptible systems.

The vulnerability, tracked as CVE-2025-23114, carries a CVSS score of 9.0 out of 10.0.

"A vulnerability within the Veeam Updater component that allows an attacker to utilize a Man-in-the-Middle attack to execute arbitrary code on the affected appliance server with root-level permissions," Veeam said in an advisory.

The shortcoming impacts the following products -

  • Veeam Backup for Salesforce — 3.1 and older
  • Veeam Backup for Nutanix AHV — 5.0 | 5.1 (Versions 6 and higher are unaffected by the flaw)
  • Veeam Backup for AWS — 6a | 7 (Version 8 is unaffected by the flaw)
  • Veeam Backup for Microsoft Azure — 5a | 6 (Version 7 is unaffected by the flaw)
  • Veeam Backup for Google Cloud — 4 | 5 (Version 6 is unaffected by the flaw)
  • Veeam Backup for Oracle Linux Virtualization Manager and Red Hat Virtualization — 3 | 4.0 | 4.1 (Versions 5 and higher are unaffected by the flaw)

It has been addressed in the below versions -

  • Veeam Backup for Salesforce - Veeam Updater component version 7.9.0.1124
  • Veeam Backup for Nutanix AHV - Veeam Updater component version 9.0.0.1125
  • Veeam Backup for AWS - Veeam Updater component version 9.0.0.1126
  • Veeam Backup for Microsoft Azure - Veeam Updater component version 9.0.0.1128
  • Veeam Backup for Google Cloud - Veeam Updater component version 9.0.0.1128
  • Veeam Backup for Oracle Linux Virtualization Manager and Red Hat Virtualization - Veeam Updater component version 9.0.0.1127

"If a Veeam Backup & Replication deployment is not protecting AWS, Google Cloud, Microsoft Azure, Nutanix AHV, or Oracle Linux VM/Red Hat Virtualization, such a deployment is not impacted by the vulnerability," the company noted.

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.

Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/02/new-veeam-flaw-allows-arbitrary-code.html