CVE-2024-42024 Privilege escalation in One
Attackers with Veeam ONE Agent service account credentials can execute arbitrary code on the host machine, requiring immediate patching.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-42024?
CVE-2024-42024 is a critical vulnerability in Veeam One, published on 7 Sep 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A vulnerability that allows an attacker in possession of the Veeam ONE Agent service account credentials to perform remote code execution on the machine where the Veeam ONE Agent is installed.
Weakness: CWE-250
Which versions are affected by CVE-2024-42024?
It affects 1 product.
Products include Veeam One.
How do I fix CVE-2024-42024?
No fix has been published for CVE-2024-42024 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-42024 being exploited?
There is no known exploitation of CVE-2024-42024 in the wild and no public exploit code.
Other vulnerabilities in Veeam One
Sources
Also known as GHSA-58p4-j3v2-9gh4.