CVE-2020-10914

CRITICAL

Veeam ONE Agent .NET Deserialization

Title source: github.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2020-10914 has a selected CVSS score of 9.8 (critical); EIP currently links 1 catalogued exploit.

Description

This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587. Authentication is not required to exploit this vulnerability. The specific flaw exists within the PerformHandshake method. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-10400.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1

Affected products and versions

1
ProductSourceVersion range

One Agent

Browse VEEAM / One Agent
CVE List9.5.4.4587affected

Proofs of concept

1

Catalogued exploits

MetasploitVeeam ONE Agent .NET DeserializationMetasploit exploitby Edgar Boda-Majer +2 moreNot analyzed1 file

Ruby · linked to 2 vulnerabilities

Metasploit
PoC details

References

4