Ransomwarecritical

Veeam addressed critical Service Provider Console (VSPC) bug

Security Affairsby @securityaffairsDec 4, 2024 · 15:12 UTC (Dec 4, 2024)2 min read2 · 1 read

Read at securityaffairs.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2024-42448 CVE-2024-42449 CVE-2024-40711

Tags: cve-2024-42448 cve-2024-42449 cve-2024-40711 ransomware

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2024-40711	Unauthenticated Deserialization RCE in Veeam Backup & Replication	9.8	90%	KEVRansomwarePoC	Sep 7, 2024 KEV Oct 17, 2024
CVE-2024-42448	Authorized-agent RCE in Veeam Service Provider Console (VSPC)	9.9	20%		Dec 12, 2024
CVE-2024-42449	From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is possible to remove arbitrary files on the…	7.1	6%		Dec 4, 2024

From the original article

2 min read at securityaffairs.com

Veeam addressed a critical vulnerability in Service Provider Console (VSPC) that could allow remote attackers to execute arbitrary code. Veeam released security updates for a critical vulnerability, tracked as CVE-2024-42448 (CVSS score of 9. 9) impacting Service Provider Console.

Security Affairs

By @securityaffairs · securityaffairs.com

Read the full article at Security Affairs

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.