CVE-2024-42024: Veeam ONE Agent RCE Vulnerability

CVE-2024-42024 Overview

CVE-2024-42024 is a remote code execution vulnerability in Veeam ONE that allows an attacker in possession of the Veeam ONE Agent service account credentials to execute arbitrary code on the machine where the Veeam ONE Agent is installed. The flaw is categorized under [CWE-250] (Execution with Unnecessary Privileges) and affects the monitoring and reporting component used across enterprise Veeam Backup environments. Veeam addressed the issue in a security update documented in the Veeam Knowledge Base Article.

Critical Impact
An authenticated attacker with valid Veeam ONE Agent service account credentials can achieve remote code execution on hosts running the agent, compromising the confidentiality, integrity, and availability of monitored backup infrastructure.

Affected Products

Veeam ONE (monitoring and analytics platform)
Veeam ONE Agent component
Deployments prior to the fixed build referenced in Veeam KB4649

Discovery Timeline

2024-09-07 - CVE-2024-42024 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-42024

Vulnerability Analysis

CVE-2024-42024 stems from the Veeam ONE Agent operating with elevated privileges combined with insufficient validation of instructions received over its authenticated communication channel. An attacker who obtains the service account credentials used by the Veeam ONE Agent can authenticate to the agent and issue commands that execute in the agent's privileged context. Because Veeam ONE is typically deployed on infrastructure servers monitoring backup jobs, a successful compromise provides a foothold on systems with broad visibility into backup operations and connected hosts.

The network-exploitable nature of the flaw means that lateral movement is straightforward once credentials are recovered from memory, configuration stores, or credential dumps on any host trusted by the agent.

Root Cause

The root cause aligns with [CWE-250]: the Veeam ONE Agent executes functionality that should be restricted, without adequately confining the actions available to authenticated callers. Rather than compartmentalizing sensitive operations, the agent trusts service-account-authenticated requests to invoke code paths that reach operating system command execution.

Attack Vector

Exploitation requires network reachability to the Veeam ONE Agent endpoint and knowledge of the service account credentials. The attacker authenticates to the agent using those credentials and then invokes agent functionality that results in code running on the underlying host. No user interaction is required. Common credential-recovery paths include LSASS extraction, DPAPI abuse, unattended installation files, and misconfigured Group Policy Preferences.

See the Veeam Knowledge Base Article for the vendor's technical description and fixed builds.

Detection Methods for CVE-2024-42024

Indicators of Compromise

Unexpected child processes spawned by the Veeam ONE Agent service (VeeamOneAgent.exe) such as cmd.exe, powershell.exe, or wmic.exe.
Authentication events for the Veeam ONE Agent service account originating from hosts other than the Veeam ONE server.
New scheduled tasks, services, or persistence artifacts created under the security context of the Veeam ONE Agent service account.

Detection Strategies

Baseline the normal process tree of the Veeam ONE Agent and alert on deviations, particularly on interactive shells or script interpreters as children.
Correlate Windows Security event ID 4624/4648 logons for the Veeam ONE service account against a known list of authorized source hosts.
Hunt for outbound network connections initiated by the Veeam ONE Agent process to non-Veeam infrastructure.

Monitoring Recommendations

Forward Veeam ONE Agent, Windows Security, and Sysmon logs to a centralized analytics platform for long-retention correlation.
Monitor credential access techniques (MITRE ATT&CK T1003, T1555) on hosts where Veeam ONE credentials may reside.
Alert on modifications to Veeam ONE configuration files and service binaries.

How to Mitigate CVE-2024-42024

Immediate Actions Required

Upgrade Veeam ONE to the fixed release documented in Veeam KB4649.
Rotate the Veeam ONE Agent service account credentials after patching, assuming prior exposure.
Restrict network access to the Veeam ONE Agent listener to authorized management hosts only.

Patch Information

Veeam released fixed builds of Veeam ONE that remediate CVE-2024-42024. Refer to the Veeam Knowledge Base Article for the exact fixed versions, upgrade procedure, and post-installation validation steps.

Workarounds

Apply host-based firewall rules restricting inbound connections to the Veeam ONE Agent port to the Veeam ONE management server.
Enforce least privilege on the service account and remove local administrator rights where the deployment supports it.
Segment Veeam infrastructure onto a dedicated management VLAN with strict egress controls.

bash

# Example: restrict inbound access to the Veeam ONE Agent port to a single management host
New-NetFirewallRule -DisplayName "Veeam ONE Agent - Restrict Inbound" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 2881 `
  -RemoteAddress 10.0.0.10 `
  -Action Allow

New-NetFirewallRule -DisplayName "Veeam ONE Agent - Block Others" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 2881 `
  -Action Block