Vulnerability · Published Feb 5, 2025 · Assigned by hackerone
CVE-2025-23114
Critical 9.0
In plain English
A critical-severity improper certificate validation in Backup for AWS from Veeam. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).
Severity (CVSS 3.0)9.0Critical
Exploit odds (30 days)0.6%top 49.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A vulnerability in Veeam Updater component allows Man-in-the-Middle attackers to execute arbitrary code on the affected server. This issue occurs due to a failure to properly validate TLS certificate.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Veeam | Backup for AWS | 7.0 – through 7.0 |
| Veeam | Backup for Microsoft Azure | 6.0 – through 6.0 |
| Veeam | Backup for Google Cloud | 5.0 – through 5.0 |
| Veeam | Backup for Nutanix AHV | 5.1 – through 5.1 |
| Veeam | Backup for Oracle Linux Virtualization Manager and Red Hat Virtualization | 4.1 – through 4.1 |
| Veeam | Backup for Salesforce | 3.1 – through 3.1 |
Weakness: CWE-295 · Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H