CVE-2024-29212
Critical
Description
Due to an unsafe de-serialization method used by the Veeam Service Provider Console(VSPC) server in communication between the management agent and its components, under certain conditions, it is possible to perform Remote Code Execution (RCE) on the VSPC server machine.
SeverityCritical
CVSS9.9
Exploit probability—
Product
Veeam Service Provider Console
PublishedMay 14, 2024
First seenMay 14, 2024
Weakness typeCWE-502Deserialization of untrusted data
How to fix
Update
- veeam veeam_service_provider_console7.0.0.19551, 8.0.0.19552 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| veeam veeam_service_provider_console | v < 7.0.0.19551, 8.0.0.18054 ≤ v < 8.0.0.19552 | 7.0.0.19551, 8.0.0.19552 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.