Veeam Service Provider Console CVEs
Our support will regularly inform you of important events here.
These CVEs let attackers remotely execute code on the VSPC server from an authorised management agent machine. Data can also be deleted or stolen... So, with scores of 9.9 and 7.1, these are definitely serious!
Veeam Service Provider Console CVEs
CVE-2024-42448
makes it possible for an attacker to remotely execute code on the VSPC server from an authorised management agent machine. This means that an attacker can gain full control over the server, which can lead to serious security problems. The severity of this vulnerability has been rated as critical, with a CVSS score of 9.9.
CVE-2024-42449
This vulnerability allows an attacker to leak an NTLM hash of the VSPC server service account and delete files on the VSPC server, also from an authorised management agent machine. This could lead to data leakage and loss of important data. The severity of this vulnerability is high, with a CVSS score of 7.1.
Risks
If you do not take action, with CVE-2024-42448, attackers can execute arbitrary code on your server. With CVE-2024-42449, attackers can steal sensitive information and delete files, which can lead to data breaches and loss of critical data.
Take action
The only solution to both vulnerabilities is to update to the latest version of Veeam Service Provider Console, version 8.1.0.21999.
Existing VanRoey 'Private Cloud' customers or customers using our console have/had nothing to fear anyway as this environment is already extra strictly secured from external access. This console will also be upgraded in a planned maintenance session in the near future, which means that the necessary security patches will be applied immediately.
No other mitigations are available, so it is essential to implement this update as soon as possible to protect your systems. Of course, we can arrange this for you.
Not a customer yet? Feel free to contact us via support@vanroey.be or count: 014 470 600. As an existing, non-managed customer, you can also have a create a ticket.
Can't create tickets? Ask here to get an account. If our Engineer needs to remotely control your PC, he or she will ask you to run this software .
