Vulnerability Details : CVE-2022-26500
Used for ransomware!
Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to internal API functions that allows attackers to upload and execute arbitrary code.
Vulnerability category: Execute code
Products affected by CVE-2022-26500
- Veeam » Veeam Backup & ReplicationVersions from including (>=) 10.0.0.4442 and before (<) 10.0.1.4854cpe:2.3:a:veeam:veeam_backup_\&_replication:*:*:*:*:*:*:*:*
- Veeam » Veeam Backup & ReplicationVersions from including (>=) 11.0.0.825 and before (<) 11.0.1.1261cpe:2.3:a:veeam:veeam_backup_\&_replication:*:*:*:*:*:*:*:*
- cpe:2.3:a:veeam:veeam_backup_\&_replication:9.5.0.1536:*:*:*:*:*:*:*
- cpe:2.3:a:veeam:veeam_backup_\&_replication:9.5.4.2615:*:*:*:*:*:*:*
- cpe:2.3:a:veeam:veeam_backup_\&_replication:10.0.1.4854:-:*:*:*:*:*:*
- cpe:2.3:a:veeam:veeam_backup_\&_replication:10.0.1.4854:p20201202:*:*:*:*:*:*
- cpe:2.3:a:veeam:veeam_backup_\&_replication:10.0.1.4854:p20210609:*:*:*:*:*:*
- cpe:2.3:a:veeam:veeam_backup_\&_replication:11.0.1.1261:-:*:*:*:*:*:*
- cpe:2.3:a:veeam:veeam_backup_\&_replication:11.0.1.1261:p20211123:*:*:*:*:*:*
- cpe:2.3:a:veeam:veeam_backup_\&_replication:11.0.1.1261:p20211211:*:*:*:*:*:*
CVE-2022-26500 is in the CISA Known Exploited Vulnerabilities Catalog
This issue is known to have been leveraged as part of a ransomware campaign.
CISA vulnerability name:
Veeam Backup & Replication Remote Code Execution Vulnerability
CISA required action:
Apply updates per vendor instructions.
CISA description:
The Veeam Distribution Service in the Backup & Replication application allows unauthenticated users to access internal API functions. A remote attacker can send input to the internal API which may lead to uploading and executing of malicious code.
Notes:
https://www.veeam.com/kb4288; https://nvd.nist.gov/vuln/detail/CVE-2022-26500
Added on
2022-12-13
Action due date
2023-01-03
Exploit prediction scoring system (EPSS) score for CVE-2022-26500
21.99%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 95 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-26500
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.5
|
MEDIUM | AV:N/AC:L/Au:S/C:P/I:P/A:P |
8.0
|
6.4
|
NIST | |
|
8.8
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
134c704f-9b21-4f2e-91b3-4a467353bcc0 | 2025-02-03 |
|
8.8
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
NIST |
CWE ids for CVE-2022-26500
-
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.Assigned by:
- 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)
- nvd@nist.gov (Primary)
References for CVE-2022-26500
-
https://veeam.com
Veeam Software - Accelerate Your Data Protection StrategyVendor Advisory
-
https://www.veeam.com/kb4288
KB4288: CVE-2022-26500 | CVE-2022-26501Vendor Advisory
Jump to