Cleartext transmission of sensitive information in Veeam products - CVE-2025-23114

Vulnerability identifier: #VU103620

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-23114

CWE-ID: CWE-319

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform MitM attack

The vulnerability exists due to software uses insecure communication channel to transmit sensitive information. A remote attacker with ability to intercept network traffic can perform MitM attack.

Veeam Updater for Veeam Backup for Salesforce
Veeam Updater for Veeam Backup for Nutanix AHV
Veeam Updater for Veeam Backup for AWS
Veeam Updater for Veeam Backup for Oracle Linux Virtualization Manager and Red Hat Virtualization
Veeam Updater for Veeam Backup for Google Cloud
Veeam Updater for Veeam Backup for Microsoft Azure

Install updates from vendor's website.

Veeam Updater for Veeam Backup for Salesforce - update to 7.9.0.1124
Veeam Updater for Veeam Backup for Nutanix AHV - update to 9.0.0.1125
Veeam Updater for Veeam Backup for AWS - update to 9.0.0.1126
Veeam Updater for Veeam Backup for Oracle Linux Virtualization Manager and Red Hat Virtualization - update to 9.0.0.1127
Veeam Updater for Veeam Backup for Google Cloud - update to 9.0.0.1128
Veeam Updater for Veeam Backup for Microsoft Azure - update to 9.0.0.1128

• https://www.veeam.com/kb4712

• MitM attack in Veeam Updater app