Date of Disclosure: December 3, 2024
CVE-2024-42448 is an RCE vulnerability in the Veeam Service Provider Console (VSPC). From the VSCP management agent machine, under the condition that the management agent is authorized on the server, it is possible to perform RCE on the VSPC server machine. This vulnerability is currently awaiting analysis in the NVD.
CVE-2024-42448 was not observed to be actively exploited at the time of writing, but threat actors have historically targeted Veeam exploits to spread Akira and Fog Ransomware.
| Field |
Details |
| CVE-ID |
CVE-2024-42448 – CVSS 9.9 (critical) – assigned by HackerOne |
| Vulnerability Description |
From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is possible to perform Remote Code Execution (RCE) on the VSPC server machine. |
| Date of Disclosure |
December 3, 2024 |
| Affected Assets |
Veeam Service Provider Console |
| Vulnerable Software Versions |
VSCP 8.1.0.21377 and all earlier versions 8 & 7 builds. |
| PoC Available? |
No public exploits available at the time of writing. |
| Exploitation Status |
CVE-2024-42448 was not observed to be actively exploited at the time of writing. |
| Patch Status |
Fixed in VSCP version 8.1.0.21999 |
Censys Perspective
At the time of writing, Censys observed 1,006 exposed VSPC instances online. A large proportion of these (49%) are geolocated in Turkey. SunExpress, a Turkish airline, uses Veeam solutions for data protection and disaster recovery, which may explain the heavy concentration of instances observed in Turkey.
Censys observed about 49% of the exposed instances to be associated with Turkcell Superonline (ASN 34984), a telecommunications provider in Turkey. Note that not all instances observed are vulnerable as we do not have specific versions available.
Map of Exposed VSPC Instances:
Censys Search Query:
services.software: (vendor="Veeam" and product="Service Provider Console") or services.http.response.html_title="Veeam Service Provider Console" and not labels: {honeypot, tarpit}
Censys ASM Query:
(host.services.software.vendor = "Veeam" and host.services.software.product = "Service Provider Console") or host.services.http.response.html_title="Veeam Service Provider Console" and not host.labels: {honeypot, tarpit}
References
