CVE-2020-10915

CRITICAL

VEEAM One Agent 9.5.4.4587 - Deserialization

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2020-10915. PoCs published by Cinnamon1212, Michael Zanetta, Edgar Boda-Majer, wvu, including Metasploit module exploits/windows/misc/veeam_one_agent_deserialization.

AI-analyzed exploit summary This is a Metasploit module exploiting a .NET deserialization vulnerability in Veeam ONE Agent (CVE-2020-10915). It sends a malicious handshake to trigger deserialization of a payload, leading to remote code execution.

Description

This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587. Authentication is not required to exploit this vulnerability. The specific flaw exists within the HandshakeResult method. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-10401.

Exploits (2)

nomisec WORKING POC
by Cinnamon1212 · poc
https://github.com/Cinnamon1212/Modified-CVE-2020-10915-MsfModule

This is a Metasploit module exploiting a .NET deserialization vulnerability in Veeam ONE Agent (CVE-2020-10915). It sends a malicious handshake to trigger deserialization of a payload, leading to remote code execution.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Veeam ONE Agent before 9.5.5.4587 and 10.0.1.750
No auth needed
Prerequisites: Network access to target on port 2805 · Vulnerable version of Veeam ONE Agent
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC NORMAL
by Michael Zanetta, Edgar Boda-Majer, wvu · rubypocwin
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/misc/veeam_one_agent_deserialization.rb

This Metasploit module exploits a .NET deserialization vulnerability in Veeam ONE Agent by sending a malicious handshake packet with a crafted serialized payload, leading to remote code execution.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Veeam ONE Agent before hotfix versions 9.5.5.4587 and 10.0.1.750
No auth needed
Prerequisites: Network access to the target on port 2805 · Vulnerable version of Veeam ONE Agent
devstral-2 · analyzed Feb 19, 2026 Full analysis →

References (3)

Core 3
Core References
Third Party Advisory, VDB Entry x_refsource_misc
https://www.zerodayinitiative.com/advisories/ZDI-20-546/
Vendor Advisory x_refsource_misc
https://www.veeam.com/kb3144

Scores

CVSS v3 9.8
EPSS 0.8662
EPSS Percentile 99.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-502
Status published
Products (1)
veeam/one 9.5.4.4587
Published Apr 22, 2020
Tracked Since Feb 18, 2026