CVE-2025-23121 | A vulnerability allowing remote code execution (RCE) on the … | CVSS 9.9 CRITICAL

Description

A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user

CVE ID: CVE-2025-23121
State: PUBLISHED
Assigner: hackerone
Reserved: 2025-01-11 01:00 UTC
Published: 2025-06-18 23:30 UTC
Last updated: 2025-06-23 16:05 UTC
Primary CWE: CWE-94
CWE-94 Improper Control of Generation of Code ('Code Injecti…
Vendor / Product: Veeam / Backup and Recovery
Sources: cve.org · NVD

9.9 CRITICAL CVSS 3.0

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC — CISA Coordinator

Affected products (1)

Vendor	Product	Platform	Versions
Veeam	Backup and Recovery	—	12.3.1 ≤ 12.3.1

Weakness (CWE)

CWE	Source	Description
CWE-94	adp	CWE-94 Improper Control of Generation of Code ('Code Injection')

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.9	CRITICAL	3.0	cna	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References (1)