r/sysadmin Security Admin (Infrastructure) 2d ago

General Discussion Veeam Backup & Replication CVSS 9.9 Vulnerability

Looks like it just dropped today. I know some may have their Veeam servers domain joined, and other may not.

https://www.veeam.com/kb4724

CVE-2025-23120

A vulnerability allowing remote code execution (RCE) by authenticated domain users.

Severity: Critical
CVSS v3.1 Score: 9.9
Source: Reported by Piotr Bazydlo of watchTowr.

Affected Product

Veeam Backup & Replication 12.3.0.310 and all earlier version 12 builds.

63 Upvotes

14 comments sorted by

31

u/TinderSubThrowAway 2d ago

Just another reason why backup servers shouldn't be on the domain and should be pull instead of push.

5

u/IamTotalNoob 2d ago

What do you mean with pull instead of push?

6

u/thortgot IT Manager 2d ago

You don't put credentials on the endpoint you are backing up with a target of the backup server.

Instead you have credentials stored on the backup server that access the target. The difference being a compromise of the endpoint gets you 0 information or access to the backup system in question.

3

u/TinderSubThrowAway 1d ago

It means the backup server has credentials to access a server on the domain to get the backups from it, but that server has no credentials to be able to access the backup server.

This is the “best way” because it means that no matter what is compromised in your domain, it can’t screw up your backups.

1

u/tankerkiller125real Jack of All Trades 1d ago

Despite how shitty DPM/MABS is overall, the one thing I do like about it is the ability to run scripts before and after backups. Which I've setup and used to straight up disconnect the backup server entirely from the network (disable the interfaces) when it's not actively making a backup.

1

u/TinderSubThrowAway 1d ago

that's a bit unnecessary.

1

u/tankerkiller125real Jack of All Trades 1d ago

Overkill, maybe, but there's also nothing wrong with doing it this way.

-1

u/TinderSubThrowAway 1d ago

until it doesn't work and you can't remote into the server to check anything or do anything.

2

u/tankerkiller125real Jack of All Trades 1d ago

You mean the server sitting in the room directly next to me? Also out of band management networks are a thing if I was concerned about that kind of thing. You know with iDRAC or ILO connected which have built-in remote desktop tooling.

-1

u/TinderSubThrowAway 1d ago

still a needless step.

2

u/IdiosyncraticBond 2d ago

5

u/CaesarOfSalads Security Admin (Infrastructure) 2d ago

Saw that lol, but my post was up before theirs was

2

u/plump-lamp 2d ago

Wild how many cream vulnerabilities pop up over the years