CVE-2024-42456 Overview
CVE-2024-42456 is a high-severity authorization flaw in Veeam Backup & Replication. A low-privileged authenticated user with a specific role can invoke a method that updates critical configuration settings. The affected method permits modification of the trusted client certificate used for authentication on a specific service port. By replacing that certificate, an attacker gains the ability to call privileged methods and initiate critical services. The weakness maps to CWE-306: Missing Authentication for Critical Function because the method enforces insufficient permission requirements.
Critical Impact
An authenticated low-privileged user can escalate privileges, execute privileged operations, and compromise the confidentiality, integrity, and availability of the backup infrastructure.
Affected Products
- Veeam Backup & Replication (see vendor advisory for fixed build numbers)
- Deployments exposing the affected authentication port on the network
- Environments where non-administrative Veeam roles are assigned to standard users
Discovery Timeline
- 2024-12-04 - CVE-2024-42456 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-42456
Vulnerability Analysis
The vulnerability resides in a remotely reachable method exposed by Veeam Backup & Replication. The method updates configuration state, including the trusted client certificate used to authenticate callers on a dedicated service port. The method's authorization check accepts a low-privileged role that should not have configuration-modification rights. After swapping the trusted certificate, the attacker authenticates as a privileged principal on that port and invokes methods reserved for administrators. The attacker can then start critical services and reach further internal APIs of the backup platform. Because Veeam Backup & Replication holds credentials for hypervisors, storage systems, and domain assets, a successful exploit provides a pivot into the wider environment.
Root Cause
The root cause is a missing or insufficient permission check on a configuration method [CWE-306]. The method trusts the caller's session role without verifying that the role carries the administrative right required to alter authentication material. The certificate-swap operation is not gated behind an integrity boundary, so any authenticated session with the specific low-privileged role can rewrite trust anchors.
Attack Vector
The attack requires network access to the Veeam Backup & Replication server and valid credentials for an account holding the specific low-privileged role. The attacker calls the vulnerable configuration method over the exposed API, uploads a certificate under attacker control, and then reconnects to the target port using that certificate. Subsequent requests execute with elevated privileges, allowing service manipulation and privileged method invocation. No user interaction is required, and the complexity is low.
No public proof-of-concept or verified exploit code is available at the time of writing. Refer to the Veeam Knowledge Base Article KB4693 for vendor-provided technical context.
Detection Methods for CVE-2024-42456
Indicators of Compromise
- Unexpected changes to the trusted client certificate configured on Veeam Backup & Replication authentication ports.
- New or unrecognized service accounts, jobs, or credential entries created shortly after a configuration change.
- Authentication events on Veeam service ports originating from hosts that do not normally connect to the backup infrastructure.
Detection Strategies
- Audit Veeam configuration and event logs for calls that update authentication or certificate settings, correlating the caller's role with the operation performed.
- Baseline the certificate thumbprints in use on Veeam service ports and alert on deviations.
- Correlate low-privileged Veeam role logins with subsequent privileged API calls or service start events on the same host.
Monitoring Recommendations
- Forward Windows event logs and Veeam application logs from backup servers into a centralized analytics platform for behavioral correlation.
- Monitor outbound and lateral connections from the Veeam Backup & Replication server, as post-exploitation activity typically pivots to hypervisors and storage.
- Track process launches under the Veeam service account for command execution patterns consistent with privilege escalation.
How to Mitigate CVE-2024-42456
Immediate Actions Required
- Apply the fixed Veeam Backup & Replication build identified in the Veeam Knowledge Base Article KB4693 as the primary remediation.
- Restrict network reachability of Veeam service ports to a management VLAN or jump host, blocking exposure to general user networks.
- Review all Veeam role assignments and remove the specific low-privileged role from accounts that do not require it.
Patch Information
Veeam has published guidance and fixed builds through KB4693. Administrators should upgrade Veeam Backup & Replication to the version listed in that advisory. Validate the upgrade by confirming the reported build number in the console and reviewing the configured trusted certificate after the update.
Workarounds
- Segment the Veeam Backup & Replication server behind a firewall that permits only administrator workstations to reach management ports.
- Rotate the trusted client certificate and Veeam service credentials if role assignments cannot be immediately reviewed.
- Enforce multi-factor authentication and dedicated administrative accounts for Veeam console access to reduce the pool of accounts that could be abused.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
