PT-2025-18716 · Msp360 · Msp360 Backup

Published 2025-05-01 · Updated 2025-05-02 · CVE-2025-43595

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MSP360 Backup version 4.3.1.115

Description An insecure file system permissions vulnerability in MSP360 Backup allows a low privileged user to execute commands with root privileges in the 'Online Backup' folder.

Recommendations Upgrade to MSP360 Backup 4.4 (released on 2025-04-22) to resolve the issue. As a temporary workaround, consider restricting access to the 'Online Backup' folder to minimize the risk of exploitation.

Fix

LPE

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2025-43595

Affected Products

Msp360 Backup

References · 13

• https://osv.dev/vulnerability/CVE-2025-43595 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-43595 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-43595 · Security Note
• https://t.me/cvedetector/24297 · Telegram Post
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-119-01.json · Note
• https://twitter.com/cybercronai/status/1918406487103189153 · Twitter Post
• https://help.msp360.com/cloudberry-backup-mac-linux/whats-new · Note
• https://twitter.com/CveFindCom/status/1918056048889364973 · Twitter Post
• https://t.me/cvetracker/22878 · Telegram Post
• https://t.me/latest_high_impact_cve/2252 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1918216511434506282 · Twitter Post
• https://t.me/cvenotify/120591 · Telegram Post
• https://twitter.com/CVEnew/status/1918181361837588872 · Twitter Post