Critical Veeam backup vulnerabilities exposed Windows users to ransomware assault
Three vulnerabilities in two Veeam products found and patched
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Two critical vulnerabilities has been discovered in Veeambackupsolutions which may have put users at risk of a ransomware attack.
Veeam Backup & Replication was found to be vulnerable to CVE-2022-26500, and CVE-2022-26501 by Positive Technologies researcher Nikita Petrov, and although specific details were not disclosed, the flaws are thought to allow unauthenticated users access to internal API functions.
“A remote attacker may send input to the internal API which may lead to uploading and executing of malicious code,” Positive’s report said.
We’re looking at how our readers use VPNs with different devices so we can improve our content and offer better advice. This survey shouldn’t take more than 60 seconds of your time. Thank you for taking part.
Click here to start the survey in a new window«
Ransomware and denial of service
The researcher did say that the vulnerabilities could be leveraged to gain initial access and establish persistence on the target endpoint, installmalware, steal data, or directly execute commands that extract, or delete data, mount denial of service attacks, or encrypt the infrastructure and run aransomwareattack.
In total, three versions of the tool were affected by the vulnerability: 9.5, 10, and 11. Patches are already available for the latter two, with users being urged to update immediately. Those that are unable to apply thepatchesright now, can temporarily stop or disable the Veeam Distribution Service to mitigate any potential risks.
It’s time to attack your ransomware recovery strategy>Ransomware attacks saw a huge rise in 2021>The average ransomware group only lives for two years
The same researcher discovered an additional vulnerability in Veeam Agent forMicrosoftWindows, which is a data backup software for the Microsoft OS. Tracked as CVE-2022-26503, the flaw allows attackers to “execute arbitrary code on the node with maximum rights (Local Privilege Escalation) gaining access to the resources of the compromised node with maximum privileges.”
In other words, any data stored on a vulnerable endpoint can be stolen, or used to mount further attacks. Versions 2.0, 2.1, 2.2, 3.0.2, 4.0, and 5.0 of the product were affected, the company confirmed. Patches for versions 4.0 and 5.0 have been issued.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
This new phishing strategy utilizes GitHub comments to distribute malware
Should your VPN always be on?
Anker Nebula Mars 3 review: A powerful and truly portable projector
