CVE-2024-40714

HighCVSS 8.3/10Last modified Jun 17, 2026

Description

An improper certificate validation vulnerability in TLS certificate validation allows an attacker on the same network to intercept sensitive credentials during restore operations.

Metrics

CVSS 3.1 8.3/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-295

Affected software

Vendor	Product	Versions
Veeam	Backup and Recovery	>= 12.1.2, <= 12.1.2
veeam	backup_\&_replication	>= 12, <= 12.1.2.172

References

https://www.veeam.com/kb4649Vendor Advisory

Timeline

Published: Sep 7, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-407157.7A vulnerability in Veeam Backup & Replication Enterprise Manager has been identified, which allows attackers to perform authentication bypas CVE-2024-407178.8A vulnerability in Veeam Backup & Replication allows a low-privileged user with certain roles to perform remote code execution (RCE) by upda CVE-2024-407188.8A server side request forgery vulnerability allows a low-privileged user to perform local privilege escalation through exploiting an SSRF vu CVE-2024-407196.5The encryption strength of the authorization keys in CHANGING Information Technology TCBServiSign Windows Version is insufficient. When a re CVE-2024-40725.4A vulnerability was found in Kashipara Online Furniture Shopping Ecommerce Website 1.0. It has been classified as problematic. Affected is a CVE-2024-407208.8The specific API in TCBServiSign Windows Version from CHANGING Information Technology does not properly validate server-side input. When a u CVE-2024-407218.8The specific API in TCBServiSign Windows Version from CHANGING Information Technology does not properly validate server-side input. When a u CVE-2024-407224.3The specific API in TCBServiSign Windows Version from CHANGING Information Technology does does not properly validate the length of server-s CVE-2024-407234.3The specific API in HWATAIServiSign Windows Version from CHANGING Information Technology does not properly validate the length of server-sid CVE-2024-407247.8Heap-based buffer overflow vulnerability in Assimp versions prior to 5.4.2 allows a local attacker to execute arbitrary code by inputting a CVE-2024-407255.3A partial fix for CVE-2024-39884 in the core of Apache HTTP Server 2.4.61 ignores some use of the legacy content-type based configuration o CVE-2024-407266.1A cross-site scripting (XSS) vulnerability in netbox v4.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload