CVE-2025-24287

Vulnerability

Overview CVE-2025-24287 is a vulnerability in Veeam Backup & Replication that allows local system users to modify directory contents. This flaw can be exploited to achieve arbitrary code execution on the local system with elevated permissions [1].

Exploitation

An attacker with local access to the system can manipulate directory contents, potentially by placing malicious files or altering existing ones. The vulnerability requires local user privileges but no authentication or network access beyond the local system [1].

Impact

Successful exploitation enables the attacker to execute arbitrary code with elevated permissions, compromising the integrity and confidentiality of the system. This could lead to full control over the affected host [1].

Mitigation

The vulnerability is resolved in Veeam Backup & Replication version 12.3.2 (build 12.3.2.3617). Users are advised to upgrade to this version or later. Unsupported product versions are likely affected and should be considered vulnerable [1].