by Kastro
Paper/Archive/CVE-2024-29212

CVE-2024-29212

Veeam Service Provider Console — Due to an unsafe de-serialization method used by the Veeam Service Provider Console(VSPC) server in communication between the management…

EPSS 2%CVSS 9.9
critical.is priorityof 100
45
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 75.1.751 × 2015.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Due to an unsafe de-serialization method used by the Veeam Service Provider Console(VSPC) server in communication between the management agent and its components, under certain conditions, it is possible to perform Remote Code Execution (RCE) on the VSPC server machine.

Affected

ProductAffectedFixed inSource
Service Provider Console8 – 8–CNA
Service Provider Console7 – 7–CNA
service_provider_console7–CISA-ADP
service_provider_console8–CISA-ADP

Scores by source

hackerone (CNA)9.9CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refveeam.com/kb4575