Uncredentialed attackers could gain administrative control of backup infrastructure
📢 Advisory Summary
Vendor: Veeam
Affected Product: Backup Enterprise Manager (All versions ≤ 12.1.2.172)
Vulnerability Type: Authentication Bypass (CWE-287)
CVSSv3 Score: 9.8 (Critical)
Attack Vector: Network-accessible HTTP interface
🔍 Technical Impact
Successful exploitation allows:
✓ Full administrative access to backup management console
✓ Unauthorized data restoration/deletion
✓ Potential credential harvesting from backup jobs
✓ Chain attacks with other vulnerabilities
🛡️ Mitigation Steps
Immediate Action: Upgrade to Veeam Backup Enterprise Manager 12.1.3 or later
Interim Measures:
Restrict network access to TCP ports 9392/tcp (web UI)
Enable MFA for all backup administrator accounts
Audit logs for [Unauthorized] AdminLogin events
Detection: Monitor for anomalous login patterns from unexpected IPs
📌 Vendor Response
Veeam has released patches and published KB article [KB4567]. No workarounds exist for unpatched systems.
📚 Additional Resources
Veeam Security Advisory VSA-2024-0123
#Cybersecurity #Veeam #PatchNow #CVE202429849 #InfoSec
Similar
-
CVE-2024-7954: Critical RCE in SPIP's Porte Plume Plugin
CVE-2024-7954: Critical RCE in SPIP's Porte Plume Plugin 2024-7954 (Cross-platform)
-
CVE-2024-22567: Security Advisory for MCMS 5.3.5
CVE-2024-22567: Security Advisory for MCMS 5.3.5 2024-22567 (Cross-platform)
-
CVE-2024-11616: Buffer Overflow in Netskope Endpoint DLP
CVE-2024-11616: Buffer Overflow in Netskope Endpoint DLP 2024-11616 (Cross-platform)
-
CVE-2024-21182: Broken Access Control in Oracle WebLogic Server
CVE-2024-21182: Broken Access Control in Oracle WebLogic Server 2024-21182: (Cross-platform)
Top Softwares
-
 – Complete Application Development Suite-64-icon.webp)
App Builder (x64) – Complete Application Development Suite
App Builder (x64) – Complete Application Development Suite 2025.7 (64-bit)
-
WinRAR for Windows
WinRAR for Windows 1.9 (64-bit)
-
Opera
Opera 32.1 (64-bit)
-
EE - Videohive - Text Number MOGRT
EE - Videohive - Text Number MOGRT 58123788 (Cross-platform)
-
Face Swap – AI Photo Editor (Pro Mod APK)
Face Swap – AI Photo Editor (Pro Mod APK) v1.1.5 (Android)
Featured
-
🎭 LoveNikki Stealer Cracked
🎭 LoveNikki Stealer Cracked Latest (64-bit)
-
🎭 Liphyra RAT 2025
🎭 Liphyra RAT 2025 Latest (64-bit)
-
📘 Software Challenges to Exascale Computing: SCEC 2018 Proceedings
📘 Software Challenges to Exascale Computing: SCEC 2018 Proceedings 2018 (Cross-platform)
-
📘 At War with the Single Strand: How Indian Science Fought the COVID-19 Pandemic
📘 At War with the Single Strand: How Indian Science Fought the COVID-19 Pandemic Latest (Cross-platform)
-
⚡ Power Supply for Railway Signaling (Indian Railways)
⚡ Power Supply for Railway Signaling (Indian Railways) Latest (Cross-platform)
