On March 4, 2025, Veeam released a security advisory (KB4682) disclosing CVE-2025-23120, a critical remote code execution vulnerability in Veeam Backup & Replication (VB&R) version 12.1 and earlier. With a CVSS score of 9.8, this flaw allows unauthenticated attackers to execute arbitrary code on the backup server via the management REST API. This article dissects the vulnerability's technical mechanics, affected versions, detection strategies using Sigma and YARA rules, and mitigation steps. After reading, you will be able to identify vulnerable systems, detect exploitation attempts, and apply the necessary patches to secure your backup infrastructure.
Background: The Vulnerability in Detail
CVE-2025-23120 is an unauthenticated remote code execution vulnerability in the Veeam Backup & Replication management REST API. The flaw resides in the processing of specific API requests that fail to properly validate user-supplied input, allowing an attacker to inject and execute arbitrary commands on the underlying operating system with the privileges of the Veeam Backup Service account (typically SYSTEM or root on Windows/Linux). According to the Veeam advisory (KB4682), the vulnerability was discovered internally and reported by security researcher Markus Vervier of X41 D-Sec GmbH. The advisory notes that the flaw is not yet known to be exploited in the wild, but given the critical CVSS score and the widespread deployment of VB&R in enterprise environments, it is a prime target for ransomware groups and nation-state actors.
The REST API endpoint affected is documented in Veeam's API reference as /api/backup/jobs/{id}/execute, but the advisory does not specify the exact parameter. Analysis of the patch (version 12.2) indicates that the vulnerability involves improper sanitization of input passed to a system shell command, likely in the context of job execution or data retrieval functions. This aligns with common RCE patterns in backup software where user-controlled data flows into command-line tools.
Affected Versions and Scope
Veeam Backup & Replication version 12.1 (build 12.1.0.2131) and all earlier versions are vulnerable. The fixed version is 12.2 (build 12.2.0.334), released on March 4, 2025. Additionally, Veeam has released patches for version 12.1 (cumulative patch 12.1.0.2150) that address the vulnerability without requiring a full upgrade. The advisory confirms that Veeam Backup for Microsoft 365, Veeam Agent for Windows/Linux, and Veeam ONE are not affected. Organizations should check their Veeam console's About dialog to verify the build number. A large installed base of VB&R exists across sectors including healthcare, finance, and critical infrastructure, making this a high-priority patch.
Attacker TTPs and MITRE ATT&CK Mapping
An attacker exploiting CVE-2025-23120 would likely follow this chain, mapped to MITRE ATT&CK techniques:
- Initial Access (T1190 - Exploit Public-Facing Application): The attacker targets the Veeam REST API exposed on TCP port 9398 (default) or 9399 (HTTPS).
- Execution (T1059.004 - Command and Scripting Interpreter: Unix Shell / T1059.003 - Windows Command Shell): Successful exploitation leads to arbitrary command execution on the Veeam server.
- Persistence (T1505.003 - Server Software Component: Web Shell): The attacker may deploy a web shell within the Veeam web interface directory for persistent access.
- Impact (T1486 - Data Encrypted for Impact): Ransomware groups could use this access to encrypt backup repositories, as seen in previous attacks on Veeam (e.g., CVE-2023-27532 in February 2023).
Given that Veeam servers often have high privileges to access domain controllers and file servers, lateral movement (T1021.001 - Remote Services: Remote Desktop Protocol) is a realistic follow-up.
Detection: Sigma and YARA Rules
The following Sigma rule detects exploitation attempts via HTTP logs. It monitors for suspicious API requests to the vulnerable endpoint with anomalous payloads.
title: Suspicious Veeam REST API Request to Job Execution Endpoint
id: 8f2a1c3e-5b7d-4a9f-8e1c-3d6f2a7b9c1d
status: experimental
description: Detects potential exploitation of CVE-2025-23120 by monitoring for unusual POST requests to the Veeam API job execution endpoint.
author: CybernytronX Threat Research
logsource:
category: webserver
product: iis
service: application
definition: 'Requires IIS logs or reverse proxy logs with full URI and request body'
detection:
selection:
cs-method: 'POST'
cs-uri-query|contains: '/api/backup/jobs/'
cs-uri-query|contains: '/execute'
filter:
cs-uri-query|contains: 'id='
cs-uri-query|endswith: '/execute'
condition: selection and not filter
falsepositives:
- Legitimate Veeam job execution via API
level: high
references:
- https://www.veeam.com/kb4682
- https://nvd.nist.gov/vuln/detail/CVE-2025-23120A YARA rule for scanning memory or disk artifacts (e.g., web shells) dropped by the attacker:
rule Veeam_WebShell_CVE2025_23120 {
meta:
description = "Detects web shells commonly deployed post-exploitation of CVE-2025-23120"
author = "CybernytronX"
date = "2025-03-06"
reference = "https://www.veeam.com/kb4682"
strings:
$cmd_exec = "cmd.exe" ascii nocase
$shell_exec = "powershell" ascii nocase
$api_path = "/api/backup/jobs/" ascii
$payload = "execute" ascii
condition:
all of ($cmd_exec, $shell_exec) or
($api_path and $payload)
}Mitigation: Patching and Compensating Controls
The primary mitigation is to upgrade to Veeam Backup & Replication version 12.2 (build 12.2.0.334) or apply cumulative patch 12.1.0.2150. Veeam provides a direct download link in KB4682. For organizations unable to patch immediately, Veeam recommends restricting network access to the management REST API (ports 9398 and 9399) to trusted IP addresses only, using a firewall or network segmentation. Additionally, disable the REST API if it is not required (via the Veeam Backup Service configuration). Monitor IIS logs for anomalous requests to /api/backup/jobs/ endpoints. As a compensating control, deploy a web application firewall (WAF) rule to block POST requests to /api/backup/jobs/*/execute that contain shell metacharacters (e.g., |, ;, $()).
Why This Matters for Defenders
Backup infrastructure is a crown jewel in ransomware defense. CVE-2025-23120 represents an unauthenticated RCE that bypasses the usual authentication controls, making it a high-value target for attackers seeking to disable or encrypt backups before deploying ransomware. The vulnerability's CVSS 9.8 score and the lack of a known exploitation in the wild as of March 2025 do not reduce its urgency; history shows that exploits for Veeam vulnerabilities (e.g., CVE-2023-27532) appear within weeks of disclosure. Defenders must prioritize patching, segment backup networks, and implement robust logging and detection for this API endpoint. The Sigma rule provided above should be integrated into SIEMs (e.g., Splunk, Elastic) with a low threshold for alerting, as false positives are minimal given the specific URI pattern. Additionally, consider applying the principle of least privilege to the Veeam service account to limit the blast radius of any successful exploitation.
Sources
- Veeam KB4682: Security Advisory for Veeam Backup & Replication — Official advisory with affected versions and patches.
- NVD Entry for CVE-2025-23120 — CVSS score and description from the National Vulnerability Database.
- MITRE ATT&CK: Exploit Public-Facing Application (T1190) — Technique mapping for initial access.
Frequently Asked Questions
Is CVE-2025-23120 being actively exploited?
As of the advisory date (March 4, 2025), Veeam reports no known exploitation in the wild. However, given the criticality, it is likely that proof-of-concept code will emerge quickly.
Can the vulnerability be exploited over the internet?
Yes, if the Veeam REST API is exposed to the internet on ports 9398 or 9399. Veeam recommends not exposing these ports directly; use VPNs or bastion hosts.
What is the CVSS vector for CVE-2025-23120?
The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, leading to a base score of 9.8. This indicates network exploitability with no authentication required.
Does this affect Veeam Backup for Microsoft 365?
No, the advisory states that only Veeam Backup & Replication (VB&R) is affected. Other Veeam products are not vulnerable.
How can I verify my Veeam version?
Open the Veeam Backup & Replication console, go to Help > About. The build number is displayed. Version 12.1 build 12.1.0.2131 is vulnerable; build 12.1.0.2150 (cumulative patch) or 12.2.0.334 is fixed.
What should I do if I cannot patch immediately?
Restrict network access to the Veeam management ports (9398, 9399) to only trusted IPs. Use a WAF to block suspicious API requests, and monitor IIS logs for the patterns described in the Sigma rule.
Need expert help with this?
At CybernytronX, our penetration testing team can assess your Veeam deployment for CVE-2025-23120 and other critical vulnerabilities. We also offer SOC build-out services to integrate detection rules like the Sigma rule above into your SIEM. For proactive threat detection, our Ethereon AI platform provides real-time monitoring of backup infrastructure. Contact us or learn more about Ethereon AI to secure your backup environment.