Veeam warns to install patches to fix a bug in its Backup & Replication product

Veeam addressed a high-severity vulnerability in the Backup Service that impacts Backup & Replication software.

Veeam addressed a high-severity vulnerability in the Backup Service, tracked as CVE-2023-27532 (CVSS v3 score: 7.5), that impacts all versions of Backup & Replication software versions.

“Vulnerability CVE-2023-27532 in Veeam Backup & Replication component allows to obtain encrypted credentials stored in the configuration database. This may lead to gaining access to the backup infrastructure hosts.” reads the advisory published by the company.

An unauthenticated attacker can exploit the vulnerability to obtain the credentials stored in the VeeamVBR configuration database and use them to access backup infrastructure hosts.

According to the advisory, the root cause of the problem is the vulnerable Veeam.Backup.Service.exe (TCP 9401 by default) process that allows an unauthenticated user to request encrypted credentials.

The flaw was addressed with the release of the following Veeam Backup & Replication build numbers:

The company credited the security researcher known as Shanigen for reporting the CVE-2023-27532 flaw in mid-February.

Veeam also provides a workaround in case customers can’t immediately apply the security updates and are using an all-in-one appliance with no remote backup infrastructure components. The vendor recommends blocking external connections to port TCP 9401 in the backup server firewall.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CVE-2023-27532)

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.