Veeam Service Provider Console Remote Code Execution Vulnerability

A remote code execution vulnerability exists in Veeam Service Provider Console versions 9.1, 9.2, and 9.2.0.33215. This vulnerability arises from script execution within alarms, which can be exploited if the 'ScriptExecutionEnabled' setting is activated.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where Veeam Service Provider Console is installed.

Remediation

Users can upgrade to Veeam Service Provider Console version 9.2.1.33875 to address this vulnerability. If an immediate upgrade is not possible, the vulnerability can be mitigated by disabling script execution in the alarm management settings and restarting the Veeam Management Portal Service.