Critical Veeam Backup Vulnerability Let Attackers Execute Arbitrary Code to Gain Root Access
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
A critical vulnerability, identified as CVE-2025-23114, has been discovered in the Veeam Updater component, a key element of multiple Veeam backup solutions<\/a>.\u00a0<\/p>\n This flaw enables attackers to execute arbitrary code on affected servers through a Man-in-the-Middle (MitM) attack, potentially granting root-level permissions.\u00a0<\/p>\n The vulnerability has been assigned a severity score of 9.0, underscoring its significant risk.<\/p>\n The vulnerability exists due to insecure communication channels used by the Veeam Updater component when transmitting sensitive data.\u00a0<\/p>\n Exploiting this flaw allows attackers positioned between the vulnerable appliance and its update<\/a> server to intercept and interfere with update requests.\u00a0<\/p>\n By injecting malicious code, attackers can gain complete control over the system, leading to potential data breaches, ransomware deployment, or persistent access within an organization\u2019s infrastructure.<\/p>\n This issue impacts various Veeam products, including:<\/p>\n Veeam has released<\/a> updates addressing CVE-2025-23114 by patching the affected Veeam Updater component in newer versions of its software.\u00a0<\/p>\n Automatic updates are enabled by default for all actively supported backup appliances, ensuring that most users will receive the fix without manual intervention.<\/p>\n The following updated versions of the Veeam Updater component resolve the vulnerability:<\/p>\nOverview of the Veeam Backup Vulnerability\u00a0<\/strong><\/h2>\n
\n