Skip to content

CVE · Exploited · On CISA KEV

CVE-2023-27532

Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability

7.5
CVSS 3.1
1
story
AUG 22
added to KEV
Severity
7.5 High · NVD score
Vendor
Veeam
Product
Backup & Replication
Published
Mar 10, 2023
Added to KEV
Aug 22, 2023
KEV deadline
Sep 12, 2023
Ransomware use
Known
Weakness
CWE-306

What it is

Veeam Backup & Replication Cloud Connect component contains a missing authentication for critical function vulnerability that allows an unauthenticated user operating within the backup infrastructure network perimeter to obtain encrypted credentials stored in the configuration database. This may lead to an attacker gaining access to the backup infrastructure hosts.

From CISA's Known Exploited Vulnerabilities catalog

Decipher coverage · 1 story

Newest first ↑
  1. IntrusionsRussian Hackers Target Misconfigured Edge Devices in ‘Concerning Evolution’ For Critical Infrastructure AttacksAmazon researchers highlighted a “tactical pivot” by Russian GRU hackers who have been moving away from zero-day and N-day exploitation.LINDSEY O'DONNELL-WELCH · 2 MIN

Official references

5 sources

Registries

RegistryNVDScore, weakness and every referenceRegistryCVE.orgThe official CVE recordRegistryCISA KEVKnown exploited, with the federal deadline

Advisories, fixes & analysis

Vendor advisoryveeam.com/kb4424Vendor advisoryveeam.com/kb4424