CVE-2024-40711

A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).

Basic Information

CVE State: PUBLISHED
Reserved Date: July 09, 2024
Published Date: September 07, 2024
Last Updated: October 29, 2024
Vendor: Veeam
Product: Backup and Recovery
Description: A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).

CVSS Scores

CVSS v3.0

9.8 - CRITICAL

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC Information

Exploitation: active
Automatable: Yes
Technical Impact: total

Exploit Status

Exploited in the Wild: Yes (added 2024-10-17 00:00:00 UTC) Source
Proof of Concept Available: Yes (added 2024-10-16 05:02:27 UTC) Source
Used in Malware: Yes (added 2024-10-17 00:00:00 UTC) Source

References

https://www.veeam.com/kb4649

Known Exploited Vulnerability Information

Source	Added Date
CISA	2024-10-17 00:00:00 UTC

Potential Proof of Concepts

Warning: These PoCs have not been tested and could contain malware. Use at your own risk.

realstatus/CVE-2024-40711-Exp

Type: github • Created: 2024-10-16 05:02:27 UTC • Stars: 41

CVE-2024-40711-exp

watchtowrlabs/CVE-2024-40711

Type: github • Created: 2024-09-15 17:25:32 UTC • Stars: 48

Pre-Auth Exploit for CVE-2024-40711