Paper/Archive/CVE-2025-23114

CVE-2025-23114

Veeam Backup for AWS — A vulnerability in Veeam Updater component allows Man-in-the-Middle attackers to execute arbitrary code on the affected server.

EPSS 0.6%CVSS 9.0

critical.is priorityof 100

CVSS 9.0 (CNA)9.0 / 10 × 3027.0 Not in CISA KEV+300.0 EPSS percentile 50.6.506 × 2010.1 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A vulnerability in Veeam Updater component allows Man-in-the-Middle attackers to execute arbitrary code on the affected server. This issue occurs due to a failure to properly validate TLS certificate.

Affected

ProductAffectedFixed inSource

Backup for AWS7.0 – 7.0–CNA

Backup for Microsoft Azure6.0 – 6.0–CNA

Backup for Google Cloud5.0 – 5.0–CNA

Backup for Nutanix AHV5.1 – 5.1–CNA

Backup for Oracle Linux Virtualization Manager and Red Hat Virtualization4.1 – 4.1–CNA

Backup for Salesforce3.1 – 3.1–CNA

Scores by source

hackerone (CNA)9.0CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refveeam.com/kb4712