What’s Vulnerable › Vulnerabilities
CVE-2024-29212
- Severity: critical (CVSS 9.9 v3.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.6% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2024-05-14 · updated 2026-06-17
- Weakness: CWE-502
Description
Due to an unsafe de-serialization method used by the Veeam Service Provider Console(VSPC) server in communication between the management agent and its components, under certain conditions, it is possible to perform Remote Code Execution (RCE) on the VSPC server machine.
Affected products
- Veeam Service Provider Console: before 7.0.0.19551; from 8.0.0.18054 before 8.0.0.19552 — fixed in 7.0.0.19551, 8.0.0.19552
How to fix
Upgrade to a fixed version: Veeam Service Provider Console 7.0.0.19551, 8.0.0.19552. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2024-29212 or the next vulnerability affects your stack