Veeam Backup & Replication Vulnerability: Encrypted Credentials at Risk
CVE-2023-27532

7.5HIGH

Key Information:

Vendor: Veeam
Status: Veeam Backup & Replication
Vendor: CVE Published:; 10 March 2023

Badges

💰 Ransomware👾 Exploit Exists🟡 Public PoC🟣 EPSS 76%🦅 CISA Reported📰 News Worthy

What is CVE-2023-27532?

A vulnerability exists within the Veeam Backup & Replication component, which could allow unauthorized individuals to access encrypted credentials stored in the configuration database. This exploit opens potential pathways to gain access to backup infrastructure hosts, posing a significant risk to data integrity and security. Proper safeguards and up-to-date patches are essential to mitigate this vulnerability and protect sensitive backup operations.

CISA has reported CVE-2023-27532

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2023-27532 as being exploited and is known by the CISA as enabling ransomware campaigns.

The CISA's recommendation is: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Affected Version(s)

Veeam Backup & Replication Fixed Versions: v12 (build 12.0.0.1420 P20230223)

Veeam Backup & Replication 11a (build 11.0.1.1261 P20230227)

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2023-27532
Created by sfewer-r7

CVE-2023-27532
Created by horizon3ai

News Articles

SecurityWeek

CVE-2023-27532

Year-Old Veeam Vulnerability Exploited in Fresh Ransomware Attacks

At least two ransomware groups have been exploiting a year-old vulnerability in Veeam Backup & Replication to exfiltrate data.

The Register

CVE-2023-27532

Veeam flaw becomes malware target a year after patching

Yet another new ransomware gang, this one dubbed EstateRansomware, is now exploiting a Veeam vulnerability that was patched more than a year ago to deploy file-encrypting malware, a LockBit variant, and...