Paper/Archive/CVE-2024-42448

CVE-2024-42448

Veeam Service Provider Console — From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is possible to perform…

EPSS 20%CVSS 9.9

critical.is priorityof 100

CVSS 9.9 (CNA)9.9 / 10 × 3029.7 Not in CISA KEV+300.0 EPSS percentile 97.5.975 × 2019.5 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is possible to perform Remote Code Execution (RCE) on the VSPC server machine.

Affected

ProductAffectedFixed inSource

Service Provider Console8.1 – 8.1–CNA

Scores by source

hackerone (CNA)9.9CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refveeam.com/kb4679