CVE-2024-40710

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A series of related high-severity vulnerabilities, the most notable enabling remote code execution (RCE) as the service account and extraction of sensitive information (savedcredentials and passwords). Exploiting these vulnerabilities requires a user who has been assigned a low-privileged role within Veeam Backup & Replication.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-522

Affected software

No affected versions have been published.

Timeline

Published: Sep 7, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-407119.8A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).CVE-2024-407127.8A path traversal vulnerability allows an attacker with a low-privileged account and local access to the system to perform local privilege es CVE-2024-407137.8A vulnerability that allows a user who has been assigned a low-privileged role within Veeam Backup & Replication to alter Multi-Factor Authe CVE-2024-407148.3An improper certificate validation vulnerability in TLS certificate validation allows an attacker on the same network to intercept sensitive CVE-2024-407157.7A vulnerability in Veeam Backup & Replication Enterprise Manager has been identified, which allows attackers to perform authentication bypas CVE-2024-407178.8A vulnerability in Veeam Backup & Replication allows a low-privileged user with certain roles to perform remote code execution (RCE) by upda CVE-2024-407188.8A server side request forgery vulnerability allows a low-privileged user to perform local privilege escalation through exploiting an SSRF vu CVE-2024-407196.5The encryption strength of the authorization keys in CHANGING Information Technology TCBServiSign Windows Version is insufficient. When a re CVE-2024-40725.4A vulnerability was found in Kashipara Online Furniture Shopping Ecommerce Website 1.0. It has been classified as problematic. Affected is a CVE-2024-407208.8The specific API in TCBServiSign Windows Version from CHANGING Information Technology does not properly validate server-side input. When a u CVE-2024-407218.8The specific API in TCBServiSign Windows Version from CHANGING Information Technology does not properly validate server-side input. When a u CVE-2024-407224.3The specific API in TCBServiSign Windows Version from CHANGING Information Technology does does not properly validate the length of server-s