Skip to main content

Veeam Releases Security Update

The security update addresses the vulnerability CVE-2023-27532, which affects the Veeam Backup & Replication Component

Threat ID:
CC-4280
Threat Severity:
Information only
Published:
10 March 2023 12:23 PM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

The security update addresses the vulnerability CVE-2023-27532, which affects the Veeam Backup & Replication Component

Affected platforms

The following platforms are known to be affected:

Versions: all prior to build 12, all prior to build 11a

Veeam Backup & Replication

Threat details

Introduction

CVE-2023-27532 is a high severity vulnerability with a CVSSv3 score of 7.5 affecting Veeam's Backup & Replication component. It allows an unauthenticated user operating within the backup infrastructure network perimeter to obtain encrypted credentials stored in the configuration database. Exploitation of this vulnerability could allow an unauthenticated attacker to gain access to the backup infrastructure hosts. 

There are reports of exploitation of CVE-2023-27532 in the wild.

Exploitation of CVE-2023-27532 in the wild

A proof-of-concept (PoC) has been publicly released for CVE-2023-27532 and exploitation in the wild has been reported.

Threat updates

Date Update
3 May 2023 Exploitation of CVE-2023-27532 in the wild

This cyber alert has been updated to reflect this change
24 Mar 2023 Proof-of-concept released for CVE-2023-27532

This cyber alert has been updated to reflect this change. 

Remediation advice

Affected organisations are encouraged to review the Veeam Security Bulletin and apply the relevant updates.

Definitive source of threat updates

Last edited: 3 May 2023 2:49 pm