Critical severity · published Feb 5, 2025
CVE-2025-23114
A vulnerability in Veeam Updater component allows Man-in-the-Middle attackers to execute arbitrary code on the affected server
9.0
CVSS
0.6%
EPSS
No
On KEV
Description
A vulnerability in Veeam Updater component allows Man-in-the-Middle attackers to execute arbitrary code on the affected server. This issue occurs due to a failure to properly validate TLS certificate.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BF
Backup for AWS · Veeam
7.0 through 7.0 · source: vendor
BF
Backup for Google Cloud · Veeam
5.0 through 5.0 · source: vendor
BF
Backup for Microsoft Azure · Veeam
6.0 through 6.0 · source: vendor
BF
Backup for Nutanix AHV · Veeam
5.1 through 5.1 · source: vendor
BF
Backup for Oracle Linux Virtualization Manager and Red Hat Virtualization · Veeam
4.1 through 4.1 · source: vendor
BF
Backup for Salesforce · Veeam
3.1 through 3.1 · source: vendor