CVE-2024-42023: 
Veeam ONE vulnerability analysis and mitigation

CVE-2024-42023 is a high-severity vulnerability affecting Veeam ONE versions 12.1.0.3208 and earlier. The vulnerability was discovered and disclosed in September 2024, allowing low-privileged users to execute code with Administrator privileges remotely (Veeam KB).

The vulnerability has been assigned a CVSS v3.1 score of 8.8 with the vector string AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a high severity level. This improper access control vulnerability enables low-privileged users to execute code with Administrator privileges through remote access (Security Online, Veeam KB).

The vulnerability's exploitation could lead to complete system compromise through privilege escalation, allowing attackers to gain administrator-level access to affected systems. This could potentially result in unauthorized access to sensitive data, system modifications, and full control over the affected Veeam ONE installation (ASEC).

Veeam has addressed this vulnerability in Veeam ONE v12.2 (build 12.2.0.4093). Organizations using affected versions are strongly advised to upgrade to the latest version to mitigate the risk. There are no known workarounds for this vulnerability, making the upgrade to the patched version essential (Veeam KB).