Full Report
Veeam has released patches for critical VSPC flaws, requiring immediate attention from affected service providers
Analysis Summary
# Vulnerability: Critical RCE and High Severity Information Disclosure/Deletion in Veeam VSPC
## CVE Details
- CVE ID: CVE-2024-42448, CVE-2024-42449
- CVSS Score: 9.9 (Critical) for CVE-2024-42448; 7.1 (High) for CVE-2024-42449
- CWE: Not explicitly stated, but CVE-2024-42448 implies Remote Code Execution, and CVE-2024-42449 suggests Information Disclosure (Hash Leakage) and Arbitrary File Deletion.
## Affected Systems
- Products: Veeam Service Provider Console (VSPC)
- Versions: All VSPC versions 8.1.0.21377 and earlier versions of builds 7 and 8. Unsupported product versions are also vulnerable.
- Configurations: Not specified, but the RCE vector is via an authorized management agent.
## Vulnerability Description
The summary details two severe vulnerabilities in Veeam Service Provider Console (VSPC):
1. **CVE-2024-42448 (CVSS 9.9, Critical):** A Remote Code Execution (RCE) vulnerability residing on the VSPC server machine, exploitable through an authorized management agent. Successful exploitation could allow an attacker to gain complete control of the system.
2. **CVE-2024-42449 (CVSS 7.1, High):** This vulnerability allows for two distinct actions: leaking the NTLM hash of the VSPC server service account and enabling file deletion on the server machine.
## Exploitation
- Status: Not explicitly stated as exploited in the wild; identified during internal testing by Veeam.
- Complexity: Given the high CVSS scores, complexity is likely Low to Medium, especially for CVE-2024-42448 (RCE via authorized agent).
- Attack Vector: CVE-2024-42448 implies exploitation over the **Network** (via management agent communication).
## Impact
- Confidentiality: High (due to NTLM hash leakage for CVE-2024-42449, and potential total compromise in CVE-2024-42448).
- Integrity: High (due to RCE in CVE-2024-42448 and arbitrary file deletion in CVE-2024-42449).
- Availability: High (potential for system disruption via RCE or file deletion).
## Remediation
### Patches
- Veeam has released a patch in **build 8.1.0.21999**. Users of supported versions are urged to apply this update immediately.
### Workarounds
- No mitigation methods are available; applying the vendor-released update is the only viable solution.
## Detection
- Detection methods were not specified in the summary. General security hygiene should include monitoring for unexpected process execution on the VSPC server and unusual network activity related to the management agent interface.
## References
- Vendor Advisory/KB: veeam com/kb4679
- Article Source: infosecurity-magazine com/news/veeam-urges-update-patch/