Remote Code Execution Vulnerability in VEEAM One Agent by Veeam
CVE-2020-10914
9.8CRITICAL
Summary
A remote code execution vulnerability in VEEAM One Agent version 9.5.4.4587 allows attackers to execute arbitrary code. This issue arises from inadequate validation of user-supplied data during the PerformHandshake method, leading to deserialization of untrusted data. Without requiring authentication, an attacker can exploit this flaw to run malicious code within the context of the service account, posing significant security risks.
Affected Version(s)
One Agent 9.5.4.4587
References
EPSS Score
55% chance of being exploited in the next 30 days.
CVSS V3.1
Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Michael Zanetta & Edgar Boda-Majer from Bugscale