Description
A vulnerability in Veeam Updater component allows Man-in-the-Middle attackers to execute arbitrary code on the affected server. This issue occurs due to a failure to properly validate TLS certificate.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Veeam | Backup for AWS | 7.0 – ≤ 7.0 | — |
| Veeam | Backup for Microsoft Azure | 6.0 – ≤ 6.0 | — |
| Veeam | Backup for Google Cloud | 5.0 – ≤ 5.0 | — |
| Veeam | Backup for Nutanix AHV | 5.1 – ≤ 5.1 | — |
| Veeam | Backup for Oracle Linux Virtualization Manager and Red Hat Virtualization | 4.1 – ≤ 4.1 | — |
| Veeam | Backup for Salesforce | 3.1 – ≤ 3.1 | — |
Advisories 1
- NCSC-2025-0060 Kwetsbaarheid verholpen in Veeam NCSC-NL (Netherlands) · Feb 13, 2025