CISA Adds High-Severity NAKIVO Path Traversal Bug to Exploited List

March 21, 2025

CISA Adds High-Severity NAKIVO Path Traversal Bug to Exploited List

Article Highlights

Off On

In a recent advisory, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) revealed a major security flaw affecting NAKIVO Backup & Replication software. This vulnerability, identified as CVE-2024-48248, with a significant CVSS score of 8.6, has been added to the Known Exploited Vulnerabilities (KEV) catalog. The bug is an absolute path traversal vulnerability, which allows unauthorized attackers to read files on the targeted host. Sensitive files, including the “/etc/shadow” file, are at risk via the “/c/router” endpoint. This vulnerability impacts all NAKIVO software versions preceding 10.11.3.86570.

Details and Mitigation

CISA’s advisory has underscored that the successful exploitation of this vulnerability could lead to adversaries gaining access to crucial data. Potentially accessible information may include configuration files, backups, and essential credentials, escalating the risk of further security breaches. Although the advisory refrained from providing specific exploitation details, it is important to note that the disclosure follows the release of a proof-of-concept (PoC) exploit by watchTowr Labs in late October. To mitigate this vulnerability, users are urged to update to version v11.0.0.88174, released in November.

This incident serves as an urgent reminder of the importance of timely software updates and adhering to cybersecurity best practices to avoid exploitation. It is particularly critical for organizations dependent on NAKIVO software for their backup and replication needs, ensuring the latest version is installed to protect against potential attacks.

Additional Vulnerabilities

Notably, two other significant vulnerabilities have been added to the KEV catalog alongside the NAKIVO flaw. One is CVE-2025-1316, with a critical CVSS score of 9.3, affecting Edimax IC-7100 IP cameras due to an OS command injection flaw. This vulnerability has been actively exploited since May by attackers targeting the cameras with default credentials, aiming to deploy Mirai botnet variants. The other vulnerability, CVE-2017-12637, with a CVSS score of 7.5, affects SAP NetWeaver Application Server (AS) Java due to a directory traversal issue.

In light of these active threats, Federal Civilian Executive Branch (FCEB) agencies have been mandated to implement necessary mitigations by April 9 to safeguard their networks. These measures are part of ongoing efforts to protect critical infrastructure and prevent unauthorized access or data breaches.

Strategic Implications

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) recently issued an advisory about a critical security flaw in NAKIVO Backup & Replication software. Labeled CVE-2024-48248, this vulnerability has a significant CVSS score of 8.6 and is now part of the Known Exploited Vulnerabilities (KEV) catalog. This issue is an absolute path traversal vulnerability, enabling unauthorized users to access and read files on the affected system. One major concern is the potential exposure of the “/etc/shadow” file through the “/c/router” endpoint, which could lead to significant security breaches. The flaw impacts all NAKIVO software versions released before 10.11.3.86570, putting sensitive information at risk. As a result, organizations using these versions should prioritize updates to mitigate the threat. This advisory highlights the necessity of promptly addressing software security vulnerabilities to protect critical infrastructure and sensitive data from malicious attacks.

Explore more

AI Redefines the Data Engineer’s Strategic Role

January 30, 2026

A self-driving vehicle misinterprets a stop sign, a diagnostic AI misses a critical tumor marker, a financial model approves a fraudulent transaction—these catastrophic failures often trace back not to a flawed algorithm, but to the silent, foundational layer of data it was built upon. In this high-stakes environment, the role of the data engineer has been irrevocably transformed. Once a

Generative AI Data Architecture – Review

January 30, 2026

The monumental migration of generative AI from the controlled confines of innovation labs into the unpredictable environment of core business operations has exposed a critical vulnerability within the modern enterprise. This review will explore the evolution of the data architectures that support it, its key components, performance requirements, and the impact it has had on business operations. The purpose of

Is Data Science Still the Sexiest Job of the 21st Century?

January 30, 2026

More than a decade after it was famously anointed by Harvard Business Review, the role of the data scientist has transitioned from a novel, almost mythical profession into a mature and deeply integrated corporate function. The initial allure, rooted in rarity and the promise of taming vast, untamed datasets, has given way to a more pragmatic reality where value is

AI Will Reshape Wealth Management for a New Generation

January 30, 2026

The financial landscape is undergoing a seismic shift, driven by a convergence of forces that are fundamentally altering the very definition of wealth and the nature of advice. A decade marked by rapid technological advancement, unprecedented economic cycles, and the dawn of the largest intergenerational wealth transfer in history has set the stage for a transformative era in US wealth