CVE-2024-40710: Veeam Backup & Replication RCE Vulnerability

CVE-2024-40710 Overview

CVE-2024-40710 represents a series of related high-severity vulnerabilities affecting Veeam Backup & Replication. The most critical of these vulnerabilities enables remote code execution (RCE) as the service account and extraction of sensitive information including saved credentials and passwords. Exploitation requires a user who has been assigned a low-privileged role within the Veeam Backup & Replication environment.

Critical Impact
Attackers with low-privileged access can achieve remote code execution and extract sensitive credentials, potentially compromising entire backup infrastructure and enabling lateral movement across enterprise environments.

Affected Products

Veeam Backup & Replication (versions prior to security patch)

Discovery Timeline

2024-09-07 - CVE-2024-40710 published to NVD
2025-05-01 - Last updated in NVD database

Technical Details for CVE-2024-40710

Vulnerability Analysis

This vulnerability chain targets Veeam Backup & Replication's credential handling and service account execution mechanisms. The core weakness relates to insufficiently protected credentials (CWE-522), where sensitive authentication data is stored or transmitted in a manner that allows extraction by users with even minimal access privileges.

The attack is network-accessible and requires low-privilege authentication within the Veeam environment. Once an attacker gains initial low-privileged access to the Veeam Backup & Replication console or API, they can leverage these vulnerabilities to escalate their access significantly. The impact is severe across all three security dimensions—confidentiality, integrity, and availability are all highly affected.

Root Cause

The root cause stems from insufficiently protected credentials (CWE-522). The Veeam Backup & Replication software does not adequately protect stored credentials, allowing authenticated users with low-privilege roles to extract sensitive information such as saved credentials and passwords. This credential exposure can then be leveraged to achieve remote code execution under the context of the service account.

Attack Vector

The attack vector is network-based and requires authentication with a low-privileged user account within the Veeam Backup & Replication system. An attacker who has been assigned any role within the application—even a minimal, read-only type role—can exploit these vulnerabilities without requiring user interaction.

The attack flow typically involves:

Authenticating to Veeam Backup & Replication with a low-privileged account
Exploiting the credential extraction vulnerability to obtain saved credentials and passwords
Using extracted credentials to achieve remote code execution as the service account
Potentially pivoting to other systems using the compromised credentials

For detailed technical information regarding the exploitation mechanism, refer to the Veeam Knowledge Base Article.

Detection Methods for CVE-2024-40710

Indicators of Compromise

Unusual credential access attempts or credential enumeration from low-privileged user accounts
Unexpected process execution under the Veeam service account context
Anomalous API calls or console activity from users with limited roles
Unauthorized access to backup configuration or credential storage areas

Detection Strategies

Monitor Veeam Backup & Replication logs for unusual credential access patterns from low-privileged accounts
Implement behavioral analysis to detect privilege escalation attempts within the Veeam environment
Alert on any execution of unexpected processes under the Veeam service account
Track authentication events and correlate with subsequent high-privilege operations

Monitoring Recommendations

Enable detailed audit logging within Veeam Backup & Replication
Configure SIEM rules to detect anomalous access patterns to credential stores
Monitor network traffic for unusual connections originating from Veeam servers
Implement file integrity monitoring on Veeam configuration and credential storage locations

How to Mitigate CVE-2024-40710

Immediate Actions Required

Apply the security patch from Veeam immediately as outlined in KB4649
Review and audit all user accounts with access to Veeam Backup & Replication
Implement principle of least privilege—remove unnecessary role assignments
Rotate all credentials stored within Veeam Backup & Replication
Isolate Veeam infrastructure on a dedicated network segment

Patch Information

Veeam has released a security patch addressing CVE-2024-40710. Organizations should consult the Veeam Knowledge Base Article KB4649 for detailed patch installation instructions and affected version information. Immediate patching is strongly recommended given the network-accessible nature of this vulnerability and the potential for credential theft and remote code execution.

Workarounds

Restrict network access to Veeam Backup & Replication management interfaces to authorized administrators only
Review and minimize the number of users with any role in the Veeam environment
Implement network segmentation to isolate backup infrastructure from general user networks
Enable multi-factor authentication for all Veeam administrative access where supported
Consider temporarily disabling low-privileged user accounts until patching is complete