CISA Adds High-Severity NAKIVO Path Traversal Bug to Exploited List

March 21, 2025

CISA Adds High-Severity NAKIVO Path Traversal Bug to Exploited List

Article Highlights

Off On

In a recent advisory, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) revealed a major security flaw affecting NAKIVO Backup & Replication software. This vulnerability, identified as CVE-2024-48248, with a significant CVSS score of 8.6, has been added to the Known Exploited Vulnerabilities (KEV) catalog. The bug is an absolute path traversal vulnerability, which allows unauthorized attackers to read files on the targeted host. Sensitive files, including the “/etc/shadow” file, are at risk via the “/c/router” endpoint. This vulnerability impacts all NAKIVO software versions preceding 10.11.3.86570.

Details and Mitigation

CISA’s advisory has underscored that the successful exploitation of this vulnerability could lead to adversaries gaining access to crucial data. Potentially accessible information may include configuration files, backups, and essential credentials, escalating the risk of further security breaches. Although the advisory refrained from providing specific exploitation details, it is important to note that the disclosure follows the release of a proof-of-concept (PoC) exploit by watchTowr Labs in late October. To mitigate this vulnerability, users are urged to update to version v11.0.0.88174, released in November.

This incident serves as an urgent reminder of the importance of timely software updates and adhering to cybersecurity best practices to avoid exploitation. It is particularly critical for organizations dependent on NAKIVO software for their backup and replication needs, ensuring the latest version is installed to protect against potential attacks.

Additional Vulnerabilities

Notably, two other significant vulnerabilities have been added to the KEV catalog alongside the NAKIVO flaw. One is CVE-2025-1316, with a critical CVSS score of 9.3, affecting Edimax IC-7100 IP cameras due to an OS command injection flaw. This vulnerability has been actively exploited since May by attackers targeting the cameras with default credentials, aiming to deploy Mirai botnet variants. The other vulnerability, CVE-2017-12637, with a CVSS score of 7.5, affects SAP NetWeaver Application Server (AS) Java due to a directory traversal issue.

In light of these active threats, Federal Civilian Executive Branch (FCEB) agencies have been mandated to implement necessary mitigations by April 9 to safeguard their networks. These measures are part of ongoing efforts to protect critical infrastructure and prevent unauthorized access or data breaches.

Strategic Implications

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) recently issued an advisory about a critical security flaw in NAKIVO Backup & Replication software. Labeled CVE-2024-48248, this vulnerability has a significant CVSS score of 8.6 and is now part of the Known Exploited Vulnerabilities (KEV) catalog. This issue is an absolute path traversal vulnerability, enabling unauthorized users to access and read files on the affected system. One major concern is the potential exposure of the “/etc/shadow” file through the “/c/router” endpoint, which could lead to significant security breaches. The flaw impacts all NAKIVO software versions released before 10.11.3.86570, putting sensitive information at risk. As a result, organizations using these versions should prioritize updates to mitigate the threat. This advisory highlights the necessity of promptly addressing software security vulnerabilities to protect critical infrastructure and sensitive data from malicious attacks.

Explore more

How Can Recruiters Shift From Attraction to Seduction?

April 30, 2026

The traditional recruitment funnel has transformed into a complex psychological maze where simply posting a vacancy no longer guarantees a single qualified applicant. Talent acquisition teams now face a reality where the once-reliable job boards remain silent, reflecting a fundamental shift in how professionals view career mobility. This quietude signifies the end of a passive era, as the modern talent

How Action Planning and Accountability Drive Better CX Scores

April 30, 2026

The perpetual stagnation of customer experience metrics often stems from a fundamental misunderstanding of what a summary score like the Net Promoter Score actually represents within a complex business ecosystem. Many organizations fall into the trap of treating the Net Promoter Score (NPS) as a strategy in itself rather than a diagnostic starting point. When leaders focus solely on the

Q4 Launches AI-Native CRM to Streamline Investor Relations

April 30, 2026

The relentless grind of manually inputting data into static spreadsheets has long been the invisible anchor dragging down the strategic potential of investor relations departments. While Investor Relations Officers (IROs) are responsible for managing sophisticated relationships for over 2,600 global brands, the digital tools at their disposal have historically lagged behind the speed of modern finance. This technological gap forced

Can a Unified CRM Close the Gap in Specialty Patient Care?

April 30, 2026

The Invisible Hurdle Between Diagnosis and Treatment The moment a physician signs a prescription for a life-altering specialty medication marks the beginning of a complex administrative endurance test that often leaves patients waiting weeks for their first dose. For a patient diagnosed with a rare or complex disease, receiving a prescription is frequently just the start of a grueling logistical

Is AI Killing the Entry-Level B2B Marketing Career Path?

April 30, 2026

The rhythmic clatter of keyboards once signaled a hive of junior marketers drafting social copy and scouring LinkedIn for prospect data, but today those sounds are replaced by the silent, instantaneous processing of large language models. For decades, the path into B2B marketing followed a predictable and necessary rite of passage. Newcomers mastered the gritty, foundational tasks of basic research