Veeam and IBM Release Patches for High
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-56346 +1 in the same advisory: …56347 | IBM AIX 7.2 and 7.3 nimesis NIM master service could allow a remote attacker to execute arbitrary commands due to improper process controls. IBM AIX 7.2 and 7.3 nimesis NIM master service could allow a remote attacker to execute arbitrary commands due to improper process controls. NVD description · AI analysis pending | 10.0 group max | 1% |
| — | ||
| CVE-2025-23120 | Domain-User RCE via Deserialization in Veeam Backup & Replication Veeam Backup & Replication contains a deserialization of untrusted data flaw (CWE-502) that allows remote code execution. Per the CVSS vector (AV:N/AC:L/PR:L/UI:N), the attack is network-reachable, straightforward to execute, and requires only low-privilege credentials — a regular domain user — with no user interaction; the vendor description states it yields RCE 'for domain users'. An attacker who obtains or already holds any domain-user account that can reach the backup server gains code execution with high confidentiality, integrity and availability impact, a foothold that is especially dangerous in backup infrastructure because those servers often hold credentials for large parts of the estate and are prime ransomware targets. Any organization running Veeam Backup & Replication is potentially affected. Veeam has released a fix (reported alongside its patch for the related CVE-2025-23121, rated 9.9, in the same product); a public technical write-up/PoC from watchTowr exists, the flaw is not yet in CISA's KEV, and EPSS assigns a 24% probability (98th percentile) of exploitation within 30 days. Do: Upgrade Veeam Backup & Replication to the patched release specified in Veeam's security advisory; if you already applied the fix for the related CVE-2025-23121 (CVSS 9.9), verify you are on the newest build, as this flaw was disclosed alongside that patch. Restrict network access to backup infrastructure, review which domain accounts can reach the B&R server, and monitor for exploitation attempts given the public PoC and elevated EPSS score. | 8.8 | 24% | PoC |
| large≈ hundreds of thousands of enterprise installations (Veeam's flagship product; Veeam has publicly reported 550,000+ customers) |
Full article401 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananMar 20, 2025Vulnerability / Software Update
Veeam has released security updates to address a critical security flaw impacting its Backup & Replication software that could lead to remote code execution.
The vulnerability, tracked as CVE-2025-23120, carries a CVSS score of 9.9 out of 10.0. It affects 12.3.0.310 and all earlier version 12 builds.
"A vulnerability allowing remote code execution (RCE) by authenticated domain users," the company said in an advisory released Wednesday.
Security researcher Piotr Bazydlo of watchTowr has been credited with discovering and reporting the flaw, which has been resolved in version 12.3.1 (build 12.3.1.1139).
According to Bazydlo and researcher Sina Kheirkhah, CVE-2025-23120 stems from Veeam's inconsistent handling of deserialization mechanism, causing an allowlisted class that can be deserialized to pave the way for an inner deserialization that implements a blocklist-based approach to prevent deserialization of data deemed risky by the company.
This also means that a threat actor could leverage a deserialization gadget missing from the blocklist – namely, Veeam.Backup.EsxManager.xmlFrameworkDs and Veeam.Backup.Core.BackupSummary – to achieve remote code execution.
"These vulnerabilities can be exploited by any user who belongs to the local users group on the Windows host of your Veeam server," the researchers said. "Better yet - if you have joined your server to the domain, these vulnerabilities can be exploited by any domain user."
The patch introduced by Veeam adds the two gadgets to the existing blocklist, meaning the solution could once again be rendered susceptible to similar risks if other feasible deserialization gadgets are discovered.
The development comes as IBM has shipped fixes to remediate two critical bugs in its AIX operating system that could permit command execution.
The list of shortcomings, which impact AIX versions 7.2 and 7.3, is below -
- CVE-2024-56346 (CVSS score: 10.0) - An improper access control vulnerability that could permit a remote attacker to execute arbitrary commands via the AIX nimesis NIM master service
- CVE-2024-56347 (CVSS score: 9.6) - An improper access control vulnerability that could permit a remote attacker to execute arbitrary commands via the AIX nimsh service SSL/TLS protection mechanism
While there is no evidence that any of these critical flaws have been exploited in the wild, users are advised to move quickly to apply the necessary patches to secure against potential threats.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/03/veeam-and-ibm-release-patches-for-high.html