Vulnerability · Published May 13, 2024 · Assigned by hackerone
CVE-2024-29212
Critical 9.9
In plain English
A critical-severity unsafe deserialization in Service Provider Console from Veeam. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 75% of all known vulnerabilities).
Severity (CVSS 3.0)9.9Critical
Exploit odds (30 days)1.6%top 24.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Due to an unsafe de-serialization method used by the Veeam Service Provider Console(VSPC) server in communication between the management agent and its components, under certain conditions, it is possible to perform Remote Code Execution (RCE) on the VSPC server machine.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Veeam | Service Provider Console | 8 – through 87 – through 7 |
Weakness: CWE-502 · Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H