PT-2025-8692 · Nakivo · Nakivo Backup & Replication

Sonny · Published 2025-02-26 · Updated 2025-07-01 · CVE-2024-48248

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions NAKIVO Backup & Replication (affected versions not specified)

Description The issue concerns an arbitrary file read vulnerability in NAKIVO Backup & Replication. Over 4,100 services have been found to be vulnerable. Approximately 208 vulnerable instances were detected as of February 26, 2025, and over 3,100 exposed targets have been identified. The vulnerability allows hackers to access sensitive data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Improper Access Control

Weakness Enumeration

CWE-284

CWE-36

Related Identifiers

BDU:2025-02355

CVE-2024-48248

Affected Products

Nakivo Backup & Replication

References · 70

• 🔥 https://github.com/watchtowrlabs/nakivo-arbitrary-file-read-poc-CVE-2024-48248/?ref=labs.watchtowr.com · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-48248 · Security Note
• https://osv.dev/vulnerability/CVE-2024-48248 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-02355 · Security Note
• https://helpcenter.nakivo.com/Release-Notes/Content/Release-Notes.htm · Security Note
• https://twitter.com/transilienceai/status/1907178940113834271 · Twitter Post
• https://t.me/cvenotify/113325 · Telegram Post
• https://twitter.com/reverseame/status/1908230113721725021 · Twitter Post
• https://twitter.com/Shadowserver/status/1895231713422569799 · Twitter Post
• https://twitter.com/fynn_JourX/status/1902948305719661059 · Twitter Post
• https://twitter.com/CipherGuardians/status/1904659759216926919 · Twitter Post
• https://t.me/cvenotify/113335 · Telegram Post
• https://twitter.com/transilienceai/status/1907179034095518141 · Twitter Post
• https://twitter.com/securityRSS/status/1903096099503739172 · Twitter Post
• https://twitter.com/secharvesterx/status/1894719281503383930 · Twitter Post