Backup, recovery, and data protection firm Veeam has released patches for two vulnerabilities in Veeam Service Provider Console, including a critical-severity flaw leading to remote code execution (RCE).
A cloud-enabled platform, the Service Provider Console enables users to manage and monitor data protection operations and services across physical, virtual, and cloud-based environments running Veeam solutions.
The critical security defect disclosed on Tuesday, tracked as CVE-2024-42448 (CVSS score of 9.9), could lead to RCE on the Service Provider Console server.
“From the VSPC management agent machine, under the condition that the management agent is authorized on the server, it is possible to perform Remote Code Execution (RCE) on the VSPC server machine,” Veeam warned in an advisory.
The second bug could be exploited under the same conditions to “leak an NTLM hash of the VSPC server service account and delete files on the VSPC server machine. The flaw is tracked as CVE-2024-42449 (CVSS score of 7.1).
Veeam Service Provider Console version 8.1.0.21377 and all version 7 and 8 build numbers are affected, the company said. Earlier versions, which are no longer supported, could be impacted as well.
Both vulnerabilities were discovered during internal testing and patches for them were included in Veeam Service Provider Console version 8.1.0.21999. No mitigation action is available for either of them, the company says.
“We encourage service providers using supported versions of Veeam Service Provider Console (versions 7 & 8) to update to the latest cumulative patch. Service Providers using unsupported versions are strongly encouraged to upgrade to the latest version of Veeam Service Provider Console,” Veeam added.
Related: Veeam Patches High-Risk Bug as Exploitation of Previous Flaw Expands
Related: Microsoft Patches Exploited Vulnerability in Partner Network Website
Related: Critical Flaws in Adobe Commerce, Photoshop, InDesign, Illustrator
Related: Google Discloses Details of Unpatched Windows AppContainer Flaw
