What’s Vulnerable › Vulnerabilities
CVE-2024-45207
- Severity: high (CVSS 7.0 v3.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2024-12-04 · updated 2026-06-17
- Weakness: CWE-426
Description
DLL injection in Veeam Agent for Windows can occur if the system's PATH variable includes insecure locations. When the agent runs, it searches these directories for necessary DLLs. If an attacker places a malicious DLL in one of these directories, the Veeam Agent might load it inadvertently, allowing the attacker to execute harmful code. This could lead to unauthorized access, data theft, or disruption of services
Affected products
- Veeam Agent for Windows: from 6.0.0.959 before 6.3.0.177 — fixed in 6.3.0.177
How to fix
Upgrade to a fixed version: Veeam Agent for Windows 6.3.0.177. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2024-45207 or the next vulnerability affects your stack