Unauthenticated Remote Code Execution (RCE) Vulnerability Discovered in Vulnerability Scanning Tool
Key Information
- Vendor
- Veeam
- Status
- Backup And Recovery
- Vendor
- CVE Published:
- 7 September 2024
Badges
Summary
The vulnerability identified as CVE-2024-40711 is an unauthenticated remote code execution (RCE) vulnerability in Veeam Backup & Replication software, with a high CVSS score of 9.8. It is actively being exploited by ransomware groups, who use it as a second stage exploit to create new local administrator accounts and facilitate further objectives on compromised networks. The attackers initially gain access to targets using compromised VPN gateways without multifactor authentication enabled, and then exploit the Veeam vulnerability to execute code remotely and deploy ransomware. Veeam has released an update (VBR version 12.2.0.334) to patch the vulnerability, and affected organizations have been advised to update their systems as soon as possible to prevent further attacks.
CISA Reported
CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2024-40711 as being exploited and is known by the CISA as enabling ransomware campaigns.
The CISA's recommendation is: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Affected Version(s)
Backup and Recovery <= 12.1.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
News Articles
Critical Veeam RCE bug now used in Frag ransomware attacks
After being used in Akira and Fog ransomware attacks, a critical Veeam Backup & Replication (VBR) security flaw was also recently exploited to deploy Frag ransomware.
1 month ago
Veeam patches 5 critical vulnerabilities, including unauthenticated RCE flaw
An advisory for 18 patched flaws includes one that could enable “full system takeover,” researchers said.
1 month ago
CVE-2024-40711Jetpack patches 8-year-old bug, and you should too
in brief A critical security update for the near-ubiquitous WordPress plugin Jetpack was released last week. Site administrators should ensure the latest version is installed to keep their sites...
2 months ago
EPSS Score
96% chance of being exploited in the next 30 days.
CVSS V3.1
Timeline
- 👾
Exploit exists.
First article discovered by The Stack
Risk change from: null to: 9.8 - (CRITICAL)
Vulnerability started trending.
- 🔥
Vulnerability reached the number 1 worldwide trending spot.
Vulnerability published.
Vulnerability Reserved.