From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is possible to perform Remote Code Execution (RCE) on the VSPC server machine.
Veeam · Service Provider Console
The flaw is in Veeam's Service Provider Console (VSPC), where a weakness in the management agent's trust relationship with the VSPC server allows code generation to be improperly controlled. An attacker who controls a machine running the VSPC management agent that is authorized on the server can achieve remote code execution on the VSPC server, provided that agent is already authorized on the server and the attacker has low-privilege access to the agent host, with no user interaction required.
- Exploited
- Yes, in VulnCheck KEV
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 43 days after disclosure. Public exploit code (PoC-in-GitHub) was available 6 days before disclosure.
- Public exploit codePoC-in-GitHub6 days before
- Disclosedday 0
- First seen exploitedVulnCheck KEV evidence+43 days
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.