High severity · published Dec 4, 2024
CVE-2024-42453
A vulnerability Veeam Backup & Replication allows low-privileged users to control and modify configurations on connected virtual infrastructure hosts
8.1
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability Veeam Backup & Replication allows low-privileged users to control and modify configurations on connected virtual infrastructure hosts. This includes the ability to power off virtual machines, delete files in storage, and make configuration changes, potentially leading to Denial of Service (DoS) and data integrity issues. The vulnerability is caused by improper permission checks in methods accessed via management services.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BR
Backup & Replication · Veeam
12.0.0.1402 before 12.3.0.310 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-42453
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-42453
Vendor Advisory
https://www.veeam.com/kb4693
More from Backup & Replication
9.8
CVE-2024-40711
Veeam Backup and Replication Deserialization Vulnerability
9.8
CVE-2022-26501
Veeam Backup & Replication Remote Code Execution Vulnerability
8.8
CVE-2022-26500
Veeam Backup & Replication Remote Code Execution Vulnerability
7.5
CVE-2023-27532
Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability
9.9
CVE-2026-21708
A vulnerability allowing a Backup Viewer to perform remote code execution (RCE) as the postgres user
