CVE-2024-40710: Veeam Backup & Replication RCE Vulnerability

CVE-2024-40710 Overview

CVE-2024-40710 represents a series of related high-severity vulnerabilities affecting Veeam Backup & Replication. The most critical of these vulnerabilities enables remote code execution (RCE) as the service account and extraction of sensitive information including saved credentials and passwords. Exploitation requires a user who has been assigned a low-privileged role within the Veeam Backup & Replication environment.

Critical Impact

Attackers with low-privileged access can achieve remote code execution and extract sensitive credentials, potentially compromising entire backup infrastructure and enabling lateral movement across enterprise environments.

Affected Products

• Veeam Backup & Replication (versions prior to security patch)

Discovery Timeline

• 2024-09-07 - CVE-2024-40710 published to NVD
• 2025-05-01 - Last updated in NVD database

Technical Details for CVE-2024-40710

Vulnerability Analysis

This vulnerability chain targets Veeam Backup & Replication's credential handling and service account execution mechanisms. The core weakness relates to insufficiently protected credentials (CWE-522), where sensitive authentication data is stored or transmitted in a manner that allows extraction by users with even minimal access privileges.

The attack is network-accessible and requires low-privilege authentication within the Veeam environment. Once an attacker gains initial low-privileged access to the Veeam Backup & Replication console or API, they can leverage these vulnerabilities to escalate their access significantly. The impact is severe across all three security dimensions—confidentiality, integrity, and availability are all highly affected.

Root Cause

The root cause stems from insufficiently protected credentials (CWE-522). The Veeam Backup & Replication software does not adequately protect stored credentials, allowing authenticated users with low-privilege roles to extract sensitive information such as saved credentials and passwords. This credential exposure can then be leveraged to achieve remote code execution under the context of the service account.

Attack Vector

The attack vector is network-based and requires authentication with a low-privileged user account within the Veeam Backup & Replication system. An attacker who has been assigned any role within the application—even a minimal, read-only type role—can exploit these vulnerabilities without requiring user interaction.

The attack flow typically involves:

1. Authenticating to Veeam Backup & Replication with a low-privileged account
2. Exploiting the credential extraction vulnerability to obtain saved credentials and passwords
3. Using extracted credentials to achieve remote code execution as the service account
4. Potentially pivoting to other systems using the compromised credentials

For detailed technical information regarding the exploitation mechanism, refer to the Veeam Knowledge Base Article.

Detection Methods for CVE-2024-40710

Indicators of Compromise

• Unusual credential access attempts or credential enumeration from low-privileged user accounts
• Unexpected process execution under the Veeam service account context
• Anomalous API calls or console activity from users with limited roles
• Unauthorized access to backup configuration or credential storage areas

Detection Strategies

• Monitor Veeam Backup & Replication logs for unusual credential access patterns from low-privileged accounts
• Implement behavioral analysis to detect privilege escalation attempts within the Veeam environment
• Alert on any execution of unexpected processes under the Veeam service account
• Track authentication events and correlate with subsequent high-privilege operations

Monitoring Recommendations

• Enable detailed audit logging within Veeam Backup & Replication
• Configure SIEM rules to detect anomalous access patterns to credential stores
• Monitor network traffic for unusual connections originating from Veeam servers
• Implement file integrity monitoring on Veeam configuration and credential storage locations

How to Mitigate CVE-2024-40710

Immediate Actions Required

• Apply the security patch from Veeam immediately as outlined in KB4649
• Review and audit all user accounts with access to Veeam Backup & Replication
• Implement principle of least privilege—remove unnecessary role assignments
• Rotate all credentials stored within Veeam Backup & Replication
• Isolate Veeam infrastructure on a dedicated network segment

Patch Information

Veeam has released a security patch addressing CVE-2024-40710. Organizations should consult the Veeam Knowledge Base Article KB4649 for detailed patch installation instructions and affected version information. Immediate patching is strongly recommended given the network-accessible nature of this vulnerability and the potential for credential theft and remote code execution.

Workarounds

• Restrict network access to Veeam Backup & Replication management interfaces to authorized administrators only
• Review and minimize the number of users with any role in the Veeam environment
• Implement network segmentation to isolate backup infrastructure from general user networks
• Enable multi-factor authentication for all Veeam administrative access where supported
• Consider temporarily disabling low-privileged user accounts until patching is complete