{"id":"CVE-2024-42448","aliases":["EUVD-2024-39436","GHSA-w4gc-9x8j-9hjv"],"status":"published","title":"From the VSPC management agent machine, under condition that the management agent is authorized...","description":"From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is possible to perform Remote Code Execution (RCE) on the VSPC server machine.","severity":{"version":"3.0","score":9.9,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.20359,"percentile":0.97501,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-94"],"published":"2024-12-11T18:52:27Z","modified":"2026-06-17T07:49:28Z","exploits":[{"source":"pocgithub","id":"h3lye/CVE-2024-42448-RCE","title":"h3lye/CVE-2024-42448-RCE","date":"2024-12-05","url":"https://github.com/h3lye/CVE-2024-42448-RCE"}],"products":[{"vendor":"veeam","product":"service provider console"}],"references":[{"url":"https://www.veeam.com/kb4679"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42448"},{"url":"https://github.com/advisories/GHSA-w4gc-9x8j-9hjv"}],"sources":{"cve":[{"id":"CVE-2024-42448","description":"From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is possible to perform Remote Code Execution (RCE) on the VSPC server machine.","status":"published","published":"2024-12-11T18:52:27.501Z","modified":"2024-12-12T14:42:44.457Z","cvss":[{"version":"3.0","score":9.9,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:34:02.652467Z"}],"euvd":[{"id":"EUVD-2024-39436","description":"From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is possible to perform Remote Code Execution (RCE) on the VSPC server machine.","status":"published","published":"2024-12-11T18:52:27Z","modified":"2024-12-12T14:42:44Z","cvss":[{"version":"3.0","score":9.9,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T00:04:36.46341Z"}],"ghsa":[{"id":"GHSA-w4gc-9x8j-9hjv","title":"From the VSPC management agent machine, under condition that the management agent is authorized...","description":"From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is possible to perform Remote Code Execution (RCE) on the VSPC server machine.","status":"published","published":"2024-12-12T03:33:03Z","modified":"2024-12-12T15:31:07Z","cvss":[{"version":"3.0","score":9.9,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:59:09.80967Z"}],"nvd":[{"id":"CVE-2024-42448","description":"From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is possible to perform Remote Code Execution (RCE) on the VSPC server machine.","status":"published","published":"2024-12-12T01:59:47.493Z","modified":"2026-06-17T07:49:28.157Z","cvss":[{"version":"3.0","score":9.9,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:10:39.792395Z"}]}}