Ce mail provient de l'extérieur, restons vigilants

=====================================================================

                            CERT-Renater

                Note d'Information No. 2025/VULN695
_____________________________________________________________________

DATE                : 15/10/2025

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Veeam Backup & Replication
                         versions prior to 12.3.2.4165.

=====================================================================
https://www.veeam.com/kb4771
_____________________________________________________________________


Vulnerabilities Resolved in Veeam Backup & Replication 12.3.2.4165
Patch
KB ID: 	4771
Product: 	Veeam Backup & Replication | 12 | 12.1 | 12.2 | 12.3
                                           | 12.3.1 | 12.3.2
Published: 	2025-10-14
Last Modified: 	2025-10-14 




All vulnerabilities documented in this article were resolved in
Veeam Backup & Replication 12.3.2.4165 Patch.

Veeam Product Latest Version Download Page


Veeam Software Security Commitment
Veeam® is committed to ensuring its products protect customers
from potential risks. As part of that commitment, we operate a
Vulnerability Disclosure Program (VDP) for all Veeam products
and perform extensive internal code audits. When a vulnerability
is identified, our team promptly develops a patch to address
and mitigate the risk. In line with our dedication to
transparency, we publicly disclose the vulnerability and
provide detailed mitigation information. This approach ensures
that all potentially affected customers can quickly implement
the necessary measures to safeguard their systems. It’s
important to note that once a vulnerability and its associated
patch are disclosed, attackers will likely attempt to
reverse-engineer the patch to exploit unpatched deployments
of Veeam software. This reality underscores the critical
importance of ensuring that all customers use the latest
versions of our software and install all updates and
patches without delay.


Issue Details


CVE-2025-48983

A vulnerability in the Mount service of Veeam Backup & Replication,
which allows for remote code execution (RCE) on the Backup
infrastructure hosts by an authenticated domain user.

Severity: Critical
CVSS v3.1 Score: 9.9
Source: Reported by CODE WHITE.

Note: This vulnerability only impacts domain-joined Veeam Backup &
Replication v12 backup infrastructure servers.
Veeam Backup & Replication Security Best Practice Guide > Workgroup or Domain?


Affected Product

Veeam Backup & Replication 12.3.2.3617 and all earlier version
12 builds.
Note: Unsupported product versions are not tested, but are
likely affected and should be considered vulnerable.

Note: The Veeam Software Appliance and upcoming Veeam Backup
& Replication v13 software for Microsoft Windows are
architecturally not impacted by these types of vulnerabilities.


Solution

This vulnerability was fixed starting in the following build:

    Veeam Backup & Replication 12.3.2.4165 Patch


CVE-2025-48984

A vulnerability allowing remote code execution (RCE) on the Backup
Server by an authenticated domain user.

Severity: Critical
CVSS v3.1 Score: 9.9
Source: Reported by Sina Kheirkhah (@SinSinology) and Piotr Bazydlo
(@chudyPB) of watchTowr.
Note: This vulnerability only impacts domain-joined
Veeam Backup & Replication v12 backup servers.

Veeam Backup & Replication Security Best Practice Guide > Workgroup or Domain?


Affected Product

Veeam Backup & Replication 12.3.2.3617 and all earlier version 12
builds.

Note: Unsupported product versions are not tested, but are likely
affected and should be considered vulnerable.

Note: The Veeam Software Appliance and upcoming Veeam Backup &
Replication v13 software for Microsoft Windows are
architecturally not impacted by these types of vulnerabilities.


Solution

This vulnerability was fixed starting in the following build:

    Veeam Backup & Replication 12.3.2.4165 Patch


CVE-2025-48982

This vulnerability in Veeam Agent for Microsoft Windows allows
for Local Privilege Escalation if a system administrator is
tricked into restoring a malicious file.

Severity: High
CVSS v3.1 Score: 7.3
Source: Reported by an anonymous contributor working with the
Trend Zero Day Initiative.
Affected Product

Veeam Agent for Microsoft Windows 6.3.2.1205 and all earlier
version 6 builds.
Note: Unsupported product versions are not tested, but are
likely affected and should be considered vulnerable.

Solution

This vulnerability was fixed starting in the following build:

    Veeam Agent for Microsoft Windows 6.3.2.1302
    Veeam Agent for Microsoft Windows is included with Veeam
Backup & Replication and available as a standalone application.


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================