Veeam Backup Deserialization RCE (2025)
- Product
- Veeam Backup & Replication
- CVE
- CVE-2025-23120
- Disclosed
- 2025-03-19
- CVSS
- 9.9
- Auth
- requires auth / interaction
- CISA KEV
- no
- Affected
- Veeam Backup & Replication 12.3.0.310 and all earlier version 12 builds on domain-joined servers.
- Fixed
- 12.3.1 (build 12.3.1.1139).
Summary
Another deserialization bug in Veeam Backup & Replication, reported by Piotr Bazydlo of watchTowr and reachable by any authenticated domain user on domain-joined servers. watchTowr pointed out that Veeam's block-list fix model kept allowing new gadget classes.
Root cause
Veeam's .NET Remoting deserialization (reached via the Veeam Mount Service) checks nested types against a block-list. The classes Veeam.Backup.EsxManager.xmlFrameworkDs and Veeam.Backup.Core.BackupSummary were not on the list and extend System.Data.DataSet, a known deserialization gadget. Any member of the host's local Users group can reach it, and on a domain-joined server that group includes Domain Users.
Impact
Any domain user can get RCE on domain-joined Veeam backup servers.
Detection
Check the Veeam build; flag domain-joined backup servers. Monitor .NET remoting traffic to the Veeam service from non-admin workstations.
Mitigation
Upgrade to 12.3.1; follow Veeam's guidance to keep backup servers in a separate workgroup/AD forest.