CVE-2023-27532:

Veeam Backup & Replication contains a vulnerability that allows attackers to extract encrypted credentials from the configuration database, potentially leading to unauthorized access to backup infrastructure hosts.

Score
A numerical rating that indicates how dangerous this vulnerability is.

7.5High

Published Date:Mar 10, 2023
CISA KEV Date:Aug 22, 2023
Industries Affected:20

Armis Early Warning:

165 Days

Threat Predictions

EPSS Score:84.2
EPSS Percentile:99%

Exploitability

Score:3.9
Attack Vector:NETWORK
Attack Complexity:LOW
Privileges Required:NONE
User Interaction:NONE
Scope:UNCHANGED

Impact

Score:3.6
Confidentiality Impact:HIGH
Integrity Impact:NONE
Availability Impact:NONE

Description Preview

Overview

This vulnerability in Veeam Backup & Replication allows attackers to obtain encrypted credentials stored in the product's configuration database. The issue is classified as CWE-306 (Missing Authentication for Critical Function), indicating that the application fails to properly authenticate users before allowing access to sensitive credential information. Once an attacker extracts these credentials, they can use them to authenticate to backup infrastructure hosts, potentially gaining control over the backup environment. This represents a significant security risk as backup systems typically have access to critical organizational data.

Remediation

Organizations using Veeam Backup & Replication should:
1. Update to the latest version of the software as recommended in Veeam KB4424
2. Follow the specific mitigation steps outlined in the vendor advisory
3. Review access controls to the Veeam management interfaces
4. Audit existing user permissions and access to the configuration database
5. Monitor for any suspicious access attempts to backup infrastructure components
6. Consider implementing network segmentation to isolate backup infrastructure