Cyber Threat

Critical Veeam Security Alert: Remote Code Execution Flaw Threatens Service Provider Console

ClickControl

Author

December 06, 2024

Published

Reading

Critical Veeam Security Alert: Remote Code Execution Flaw Threatens Service Provider Console

Critical Security Update: Veeam Addresses Severe Vulnerabilities in Service Provider Console

Veeam has released urgent security patches for two significant vulnerabilities discovered in their Service Provider Console (VSPC). The first critical flaw (CVE-2024-42448), rated at 9.9 out of 10, enables remote code execution on vulnerable servers through management agent machines. The second high-severity vulnerability (CVE-2024-42449) allows attackers to steal NTLM hashes of server service accounts and delete files on VSPC servers.

The vulnerabilities affect VSPC versions 8.1.0.21377 and earlier, including builds 8 and 7. While exploitation requires an authorized management agent, the risk is significant given Veeam’s extensive market presence, serving over 550,000 customers worldwide, including 74% of Global 2,000 and 82% of Fortune 500 companies.

Given the history of ransomware groups actively exploiting Veeam vulnerabilities, service providers are strongly advised to implement the latest cumulative patch or upgrade to the newest VSPC version immediately to protect their systems.

Keywords: Veeam security vulnerabilities, VSPC patch update, remote code execution vulnerability, Veeam Service Provider Console, ransomware protection, critical security patches

Share This Article