CVE-2024-40710
📋 TL;DR
This CVE describes multiple high-severity vulnerabilities in Veeam Backup & Replication that allow authenticated low-privileged users to execute remote code as the service account and extract sensitive credentials. Organizations using affected Veeam versions with any low-privileged user accounts are at risk of complete system compromise.
💻 Affected Systems
- Veeam Backup & Replication
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system takeover with service account privileges, credential theft enabling lateral movement, and potential ransomware deployment across backup infrastructure.
Likely Case
Attackers with initial low-privileged access escalate to service account, steal backup credentials, and exfiltrate sensitive data from backup repositories.
If Mitigated
Limited to credential exposure without code execution if proper network segmentation and least privilege are implemented.
🎯 Exploit Status
Exploitation requires authenticated low-privileged access but is straightforward once initial access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 12.1.2.172 (build 12.1.2.172)
Vendor Advisory: https://www.veeam.com/kb4649
Restart Required: Yes
Instructions:
1. Download cumulative patch from Veeam KB4649. 2. Stop all backup jobs. 3. Install patch on all Veeam servers. 4. Restart services/servers as prompted. 5. Verify patch installation in Help > About.
🔧 Temporary Workarounds
Remove low-privileged accounts
windowsTemporarily remove or disable all low-privileged user accounts from Veeam Backup & Replication console
Use Veeam console: Users and Roles > Remove non-essential accounts
Network segmentation
windowsRestrict access to Veeam console to trusted administrative networks only
Windows Firewall: New Inbound Rule restricting 9392/TCP, 9393/TCP to admin subnets
🧯 If You Can't Patch
- Implement strict network segmentation - isolate Veeam infrastructure from general network access
- Apply principle of least privilege - remove all non-essential low-privileged accounts immediately
🔍 How to Verify
Check if Vulnerable:
Check Veeam version in console: Help > About. If version is 12.1.2.172 or earlier, system is vulnerable.Check Version:
In Veeam console: Help > About displays version informationVerify Fix Applied:
Verify version shows 12.1.2.172 (build 12.1.2.172) or later in Help > About. Check patch installation logs at C:\ProgramData\Veeam\Backup\PatchLogs.📡 Detection & Monitoring
Log Indicators:
- Unusual service account activity in Windows Event Logs
- Multiple failed authentication attempts followed by successful low-privileged login
- Unexpected process creation by Veeam service account
Network Indicators:
- Unusual outbound connections from Veeam server on non-standard ports
- Multiple authentication attempts to Veeam console from single source
SIEM Query:
source="Windows Security" EventCode=4624 LogonType=3 AccountName="VEEAM*" AND source="Windows Security" EventCode=4688 ParentProcessName="*Veeam*"