CVE-2024-29212

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-29212
Due to an unsafe de-serialization method used by the Veeam Service Provider Console(VSPC) server in communication between the management agent and its components, under certain conditions, it is possible to perform Remote Code Execution (RCE) on the VSPC server machine.

9.9 /10

CVSS v3 : CRITICAL

V3 Legend

Vector : AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Exploitability : 3.1 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://www.veeam.com/kb4575 Vendor Advisory
https://www.veeam.com/kb4575 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:veeam:veeam_service_provider_console:*:*:*:*:*:*:*:*
cpe:2.3:a:veeam:veeam_service_provider_console:*:*:*:*:*:*:*:*
History

30 Jun 2025, 17:53

Type Values Removed Values Added
CPE cpe:2.3:a:veeam:veeam_service_provider_console:*:*:*:*:*:*:*:*
First Time Veeam
Veeam veeam Service Provider Console
References () https://www.veeam.com/kb4575 - () https://www.veeam.com/kb4575 - Vendor Advisory

21 Nov 2024, 09:07

Type Values Removed Values Added
References () https://www.veeam.com/kb4575 - () https://www.veeam.com/kb4575 -

03 Jul 2024, 01:52

Type Values Removed Values Added
CWE CWE-502
Summary
  • (es) Debido a un método de deserialización inseguro utilizado por el servidor Veeam Service Provider Console (VSPC) en la comunicación entre el agente de administración y sus componentes, bajo ciertas condiciones, es posible realizar la ejecución remota de código (RCE) en la máquina del servidor VSPC.

14 May 2024, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-14 15:15

Updated : 2025-06-30 17:53

NVD link : CVE-2024-29212

Mitre link : CVE-2024-29212

CVE.ORG link : CVE-2024-29212

JSON object : View

Products Affected

veeam

  • veeam_service_provider_console
CWE
CWE-502

Deserialization of Untrusted Data