PT-2025-4830 · Veeam · Veeam Updater

Putsivia · Published 2025-01-11 · Updated 2025-10-16 · CVE-2025-23114

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Veeam (affected versions not specified)

Description A vulnerability in the Veeam Updater component allows Man-in-the-Middle attackers to execute arbitrary code on the affected server due to a failure to properly validate TLS certificates. This issue enables remote code execution via a Man-in-the-Middle attack. Over 32,000 services are potentially affected. The vulnerability has been actively exploited.

Recommendations Apply Veeam's latest updates to address the vulnerability. Ensure all Veeam products are updated to their latest versions to mitigate this critical issue. As a temporary workaround, consider restricting access to the Veeam Updater component until a patch is available.

Fix

RCE

Improper Certificate Validation

Weakness Enumeration

CWE-300

CWE-295

Related Identifiers

BDU:2025-01584

CVE-2025-23114

Affected Products

Veeam Updater

References · 58

• https://nvd.nist.gov/vuln/detail/CVE-2025-23114 · Security Note
• https://bdu.fstec.ru/vul/2025-01584 · Security Note
• https://twitter.com/f1tym1/status/1889924950569480522 · Twitter Post
• https://twitter.com/samilaiho/status/1887084489353880001 · Twitter Post
• https://t.me/cvenotify/110061 · Telegram Post
• https://twitter.com/transilienceai/status/1887304913148899350 · Twitter Post
• https://twitter.com/riskigy/status/1887943163907645578 · Twitter Post
• https://twitter.com/socradar/status/1887078724480209093 · Twitter Post
• https://twitter.com/kpoireault/status/1903137028394680650 · Twitter Post
• https://twitter.com/TMJIntel/status/1887182399789748319 · Twitter Post
• https://reddit.com/r/Veeam/comments/1ihoi7x/kb_4712_cve202523114_veeam_updater_component · Reddit Post
• https://twitter.com/transilienceai/status/1888379633806008829 · Twitter Post
• https://t.me/thehackernews/6291 · Telegram Post
• https://twitter.com/HunterMapping/status/1888069944455082002 · Twitter Post
• https://vulners.com/cve/CVE-2025-23114 · Note