CVE-2024-42455
Published: 04 December 2024
Summary
CVE-2024-42455 is a high-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Veeam Veeam Backup \& Replication. Its CVSS base score is 8.1 (High).
Operationally, ranked in the top 11.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
A vulnerability in Veeam Backup & Replication enables a low-privileged user to connect to remoting services and trigger insecure deserialization by submitting a serialized temporary file collection. The flaw stems from an insufficient blacklist in the deserialization process and permits deletion of arbitrary files on the system under service-account privileges. The issue carries a CVSS 3.1 score of 8.1 and is tracked as CWE-306.
An attacker with low-privileged access can exploit the deserialization path over the network to achieve high-impact integrity and availability effects without user interaction. Exploitation requires only the ability to reach the remoting services and craft a malicious serialized object.
The vendor has published remediation guidance in knowledge-base article KB4693. The EPSS score has remained low, reaching a peak of 0.0517 before receding to the current value of 0.0402.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-39889
Vulnerability details
A vulnerability in Veeam Backup & Replication allows a low-privileged user to connect to remoting services and exploit insecure deserialization by sending a serialized temporary file collection. This exploit allows the attacker to delete any file on the system with…
more
service account privileges. The vulnerability is caused by an insufficient blacklist during the deserialization process.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Requires established identification and authentication to unlock, mitigating missing authentication for continued system access.
Requiring identification and rationale for actions allowed without authentication ensures critical functions are not left unprotected by forcing review of authentication requirements.
Authorizing mobile device connections to organizational systems ensures authentication is performed for this critical access function.
Guarantees critical functions are protected by mandatory invocation of the access control mechanism.
Auditing sessions makes it possible to detect access to critical functions without required authentication.
The assessment process confirms authentication is present and effective for critical functions, preventing exploitation from missing authentication.
Certification assesses that critical functions have required authentication controls in place.
Disabling non-essential functions and services eliminates the need to secure them, reducing exposure from missing authentication on unnecessary components.