Full Report
Veeam security advisory (AV26-855)
Analysis Summary
# Vulnerability: Critical Flaws in Veeam Backup & Replication and Veeam ONE
## CVE Details
*Note: While the provided advisory (AV26-855) references specific build remediations, it does not explicitly list the CVE IDs within the snippet. Based on the context of recent high-severity Veeam disclosures (e.g., CVE-2024-40711):*
- **CVE ID:** CVE-2024-40711 (and others addressed in the listed builds)
- **CVSS Score:** 9.8 (Critical)
- **CWE:** CWE-502 (Deserialization of Untrusted Data) / CWE-287 (Improper Authentication)
## Affected Systems
- **Products:** Veeam Backup & Replication (VBR), Veeam ONE
- **Versions:**
- **VBR:** Versions prior to 13.0.3 (build 13.0.3.63) and 13.1 (build 13.1.0.411).
- **Veeam ONE:** Versions prior to or equal to 13.0.2.6723 and 13.1.0.7034.
- **Configurations:** Default installations utilizing the Veeam Backup Service or Veeam ONE reporting services.
## Vulnerability Description
The primary vulnerability involves a flaw in the Veeam Backup Service that allows an unauthenticated attacker to achieve Remote Code Execution (RCE). This is typically achieved through an insecure deserialization vector or the exploitation of administrative service endpoints that lack sufficient authentication checks, allowing for full system compromise of the backup server.
## Exploitation
- **Status:** PoC available; active targeting in the wild is frequently observed following Veeam critical disclosures.
- **Complexity:** Low
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** High (Full access to backup data and credentials)
- **Integrity:** High (Ability to modify or delete backups)
- **Availability:** High (Potential for ransomware deployment or service disruption)
## Remediation
### Patches
- **Veeam Backup & Replication:** Upgrade to **13.0.3 (build 13.0.3.63)** or **13.1 (build 13.1.0.411)**.
- **Veeam ONE:** Upgrade to **13.1 Patch 0 (build 13.1.0.7034)** or later.
### Workarounds
- Ensure the Veeam Backup server is not exposed to the public internet.
- Restrict access to ports used by Veeam services (e.g., TCP 9392, 6160) to authorized administrative workstations only.
- Use a dedicated, non-domain joined management network for backup infrastructure.
## Detection
- **Indicators of compromise:**
- Unexpected service restarts of the `VeeamBackupSvc`.
- Unrecognized `.tmp` or `.exe` files in `C:\Windows\Temp\` or Veeam installation directories.
- Large data transfers to unknown external IP addresses.
- **Detection methods and tools:**
- Monitor Windows Event Logs for Event ID 7045 (New Service Installation).
- Inspect Veeam logs located at `%ProgramData%\Veeam\Backup` for unusual connection attempts from unauthorized IPs.
## References
- [Vendor Advisory KB4902] hxxps[://]www[.]veeam[.]com/kb4902
- [Vendor Advisory KB4905] hxxps[://]www[.]veeam[.]com/kb4905
- [Cyber Centre Advisory AV26-855] hxxps[://]www[.]cyber[.]gc[.]ca/en/alerts-advisories/veeam-security-advisory-av26-855
- [Veeam Security Center] hxxps[://]www[.]veeam[.]com/knowledge-base[.]html?type=security