CVE-2025-55125
📋 TL;DR
This vulnerability allows authenticated Backup or Tape Operators to execute arbitrary code with root privileges by creating a malicious backup configuration file. It affects Veeam Backup & Replication installations where these operators have configuration access. The attacker must already have valid operator credentials to exploit this vulnerability.
💻 Affected Systems
- Veeam Backup & Replication
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with root privileges, allowing complete control over the backup server, data exfiltration, and lateral movement to other systems.
Likely Case
Privilege escalation from Backup/Tape Operator to root, enabling data theft, backup manipulation, and persistence on the system.
If Mitigated
Limited impact if proper access controls restrict configuration file creation to trusted administrators only.
🎯 Exploit Status
Exploitation requires authenticated access as Backup/Tape Operator and knowledge of the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version specified in Veeam KB4792
Vendor Advisory: https://www.veeam.com/kb4792
Restart Required: Yes
Instructions:
1. Download the patch from Veeam KB4792. 2. Stop all backup jobs. 3. Install the patch. 4. Restart the Veeam Backup Service. 5. Verify installation and restart backup jobs.
🔧 Temporary Workarounds
Restrict Configuration Permissions
windowsLimit backup configuration file creation to trusted administrators only, removing these permissions from Backup/Tape Operators.
Use Veeam console: Navigate to Users and Roles, modify role permissions to remove configuration file creation rights
🧯 If You Can't Patch
- Implement strict access controls to limit Backup/Tape Operator permissions to only essential functions
- Monitor for suspicious configuration file creation activities and audit operator actions regularly
🔍 How to Verify
Check if Vulnerable:
Check Veeam Backup & Replication version against the patched version in KB4792Check Version:
In Veeam console: Help > About or check installed programs in WindowsVerify Fix Applied:
Verify the installed version matches or exceeds the patched version from KB4792📡 Detection & Monitoring
Log Indicators:
- Unusual backup configuration file creation by Backup/Tape Operators
- Suspicious process execution from backup service context
Network Indicators:
- Unusual outbound connections from backup server following configuration changes
SIEM Query:
source="veeam_logs" AND (event="configuration_created" OR event="process_execution") AND user_role="backup_operator"