CVE-2024-38651
Published: 07 September 2024
Summary
CVE-2024-38651 is a high-severity Code Injection (CWE-94) vulnerability in Veeam (inferred from references). Its CVSS base score is 8.5 (High).
Operationally, ranked in the top 12.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
A code injection vulnerability tracked as CVE-2024-38651 affects the Veeam Service Provider Console (VSPC) server. The flaw, assigned CWE-94, permits a low-privileged user to overwrite arbitrary files on the server, which can be leveraged to achieve remote code execution. It carries a CVSS 3.0 base score of 8.5 reflecting network attack vector, high impact on confidentiality, integrity, and availability, and the requirement for some user privileges.
An attacker with low-privileged credentials on the VSPC server can exploit the issue remotely without user interaction. Successful exploitation allows the attacker to overwrite files and ultimately execute arbitrary code on the server, potentially leading to full compromise of the VSPC instance and any connected backup or management infrastructure.
The associated Veeam advisory at https://www.veeam.com/kb4649 provides official guidance on the issue. Exploitation probability as measured by EPSS rose from a low baseline to a peak of 0.0678 on 2025-12-11 before receding to the current value of 0.0320, indicating a period of increased exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-37506
Vulnerability details
A code injection vulnerability can allow a low-privileged user to overwrite files on that VSPC server, which can lead to remote code execution on VSPC server.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Makes persistent code injection into loaded programs impossible when the executable image itself resides on hardware-protected read-only media.
Dynamically generated code can be produced and executed inside the isolated chamber, preventing host compromise from code-injection payloads.
Validates inputs used in dynamic code generation to block injected directives.
Directly prevents execution of attacker-supplied code written into data memory regions.