Unauthenticated Remote Code Execution (RCE) Vulnerability Discovered in Vulnerability Scanning Tool

CVE-2024-40711
9.8CRITICAL

Key Information

Vendor
Veeam
Status
Backup And Recovery
Vendor
CVE Published:
7 September 2024

Badges

🔥 No. 1 Trending😄 Trended👾 Exploit Exists🔴 Public PoC🟣 EPSS 96%📰 News Worthy

Summary

The vulnerability identified as CVE-2024-40711 is an unauthenticated remote code execution (RCE) vulnerability in Veeam Backup & Replication software, with a high CVSS score of 9.8. It is actively being exploited by ransomware groups, who use it as a second stage exploit to create new local administrator accounts and facilitate further objectives on compromised networks. The attackers initially gain access to targets using compromised VPN gateways without multifactor authentication enabled, and then exploit the Veeam vulnerability to execute code remotely and deploy ransomware. Veeam has released an update (VBR version 12.2.0.334) to patch the vulnerability, and affected organizations have been advised to update their systems as soon as possible to prevent further attacks.

CISA Reported

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2024-40711 as being exploited and is known by the CISA as enabling ransomware campaigns.

The CISA's recommendation is: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Affected Version(s)

Backup and Recovery <= 12.1.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

News Articles

EPSS Score

96% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 👾

    Exploit exists.

  • First article discovered by The Stack

  • Risk change from: null to: 9.8 - (CRITICAL)

  • Vulnerability started trending.

  • 🔥

    Vulnerability reached the number 1 worldwide trending spot.

  • Vulnerability published.

  • Vulnerability Reserved.

Collectors

NVD DatabaseMitre DatabaseCISA Database3 Proof of Concept(s)14 News Article(s)
.