PT-2021-21090 · Veeam+1 · Veeam Backup & Replication+1

Markus Wulftange · Published 1999-01-01 · Updated 2021-07-06 · CVE-2021-35971

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Veeam Backup and Replication versions 10.0.0 through 10.0.1.4854 P20210608 and versions 11.0.0 through 11.0.0.836 P20210506

Description: The issue is related to the mishandling of deserialization during Microsoft .NET remoting.

Recommendations: For Veeam Backup and Replication version 10, update to version 10.0.1.4854 P20210609 or later. For Veeam Backup and Replication version 11, update to version 11.0.0.837 P20210507 or later.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2021-35971

DOTNETREMOTINGCHECK

Affected Products

.Net Framework

Veeam Backup & Replication

References · 7

• https://veeam.com/kb4180 · Vendor Advisory
• https://veeam.com/kb4126 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-35971 · Security Note
• https://osv.dev/vulnerability/CVE-2021-35971 · Vendor Advisory
• https://t.me/cibsecurity/25826 · Telegram Post
• https://t.me/cvenotify/16926 · Telegram Post
• https://t.me/cvenotify/17162 · Telegram Post