CVE-2024-29853: 
Veeam Backup & Replication vulnerability analysis and mitigation

An authentication bypass vulnerability in Veeam Agent for Microsoft Windows allows for local privilege escalation. The vulnerability, tracked as CVE-2024-29853, was discovered in May 2024 and affects multiple versions of Veeam Agent for Microsoft Windows (Veeam KB).

The vulnerability has been assigned a CVSS v3.0 base score of 7.8 (High) with the following vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The weakness is categorized as CWE-288 (Authentication Bypass Using an Alternate Path or Channel) (NVD).

The vulnerability could allow an attacker to perform local privilege escalation on affected systems, potentially gaining elevated access to system resources (Hacker News).

The vulnerability requires local access to the system and low privileges to exploit. No public exploits have been reported at the time of disclosure (NVD).

Veeam has addressed this vulnerability in Veeam Agent for Microsoft Windows version 6.1.2 (build 6.1.2.134), which was included with Veeam Backup & Replication 12.1.2.172. Users are strongly advised to upgrade to the patched version (Veeam KB).