Veeam Service Provider Console
At a glance
- Source
- NVD
- EPSS
- EPSS 1.55 % · percentile 75 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- hackerone
- NVD status
- Analyzed
Description
Due to an unsafe de-serialization method used by the Veeam Service Provider Console(VSPC) server in communication between the management agent and its components, under certain conditions, it is possible to perform Remote Code Execution (RCE) on the VSPC server machine.
Weaknesses (CWE)
- CWE-502 — Deserialization of Untrusted Data
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.0 | CRITICAL 9.9 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H | hackerone |
| CVSS 3.0 | CRITICAL 9.9 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H | NVD · support@hackerone.com (Secondary) |
European references
- ENISA EUVD · EUVD-2024-26229
- GCVE · GCVE-0-2024-29212
CERT-FR advisories
- CERTFR-2024-AVI-0374 — Vulnérabilité dans Veeam Service Provider Console · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:veeam:veeam_service_provider_console:*:*:*:*:*:*:*:*< 7.0.0.19551cpe:2.3:a:veeam:veeam_service_provider_console:*:*:*:*:*:*:*:*≥ 8.0.0.18054 < 8.0.0.19552
Affected products
| Product | Versions |
|---|---|
| Veeam · Service Provider Console | affected 8 ≤ 8 ; affected 7 ≤ 7 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |