VA-25-119-01
Vulnerability from csaf_cisa - Published: 2025-04-29 15:59 - Updated: 2025-05-19 00:00Summary
MSP360 Backup insecure filesystem permissions
Notes
Legal Notice
All information products included in [https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white](https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white) are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see [https://us-cert.cisa.gov/tlp/](https://us-cert.cisa.gov/tlp/).
Countries and Areas Deployed
Worldwide
Critical Infrastructure Sectors
Information Technology
Risk Evaluation
MSP360 Backup is a data backup and recovery solution. Insecure file system permission vulnerabilities in both the Windows and Linux versions allow a lower privileged user to execute commands the privileges of other users, including administrative users. An attacker could exploit these vulnerabilities to obtain user credentials, redirect the backup target to obtain the data being backed up, and execute commands with the privileges of other (possibly administrative) users.
Recommended Practices
Upgrade to MSP360 Backup (for Linux) 4.4 (released on 2025-04-22) or MSP360 Backup (for Windows) 8.1.1.19 (released on 2025-05-15).
Company Headquarters Location
United States
{
"document": {
"category": "csaf_vex",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE"
}
},
"lang": "en-US",
"notes": [
{
"category": "legal_disclaimer",
"text": "All information products included in [https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white](https://github.com/cisagov/CSAF/tree/develop/csaf_files/IT/white) are provided \\\"as is\\\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see [https://us-cert.cisa.gov/tlp/](https://us-cert.cisa.gov/tlp/).",
"title": "Legal Notice"
},
{
"category": "other",
"text": "Worldwide",
"title": "Countries and Areas Deployed"
},
{
"category": "other",
"text": "Information Technology",
"title": "Critical Infrastructure Sectors"
},
{
"category": "summary",
"text": "MSP360 Backup is a data backup and recovery solution. Insecure file system permission vulnerabilities in both the Windows and Linux versions allow a lower privileged user to execute commands the privileges of other users, including administrative users. An attacker could exploit these vulnerabilities to obtain user credentials, redirect the backup target to obtain the data being backed up, and execute commands with the privileges of other (possibly administrative) users.",
"title": "Risk Evaluation"
},
{
"category": "general",
"text": "Upgrade to MSP360 Backup (for Linux) 4.4 (released on 2025-04-22) or MSP360 Backup (for Windows) 8.1.1.19 (released on 2025-05-15).",
"title": "Recommended Practices"
},
{
"category": "other",
"text": "United States",
"title": "Company Headquarters Location"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "https://www.cisa.gov/report",
"issuing_authority": "CISA",
"name": "CISA",
"namespace": "https://www.cisa.gov/"
},
"references": [
{
"category": "self",
"summary": "Vulnerability Advisory VA-25-119-01 CSAF",
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-119-01.json"
}
],
"title": "MSP360 Backup insecure filesystem permissions",
"tracking": {
"current_release_date": "2025-05-19T00:00:00Z",
"generator": {
"engine": {
"name": "VINCE-NT",
"version": "1.9.0"
}
},
"id": "VA-25-119-01",
"initial_release_date": "2025-04-29T15:59:52Z",
"revision_history": [
{
"date": "2025-05-19T00:00:00Z",
"number": "2.0.0",
"summary": "Added CVE-2025-43596"
},
{
"date": "2025-04-29T15:59:52Z",
"number": "1.0.0",
"summary": "Initial publication"
}
],
"status": "final",
"version": "2.0.0"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "4.3.1.115",
"product": {
"name": "MSP360 Backup 4.3.1.115",
"product_id": "CSAFPID-0001"
}
},
{
"category": "product_version",
"name": "4.4",
"product": {
"name": "MSP360 Backup 4.4",
"product_id": "CSAFPID-0002"
}
},
{
"category": "product_version",
"name": "8.0",
"product": {
"name": "MSP360 Backup 8.0",
"product_id": "CSAFPID-0003"
}
},
{
"category": "product_version",
"name": "8.1.1.19",
"product": {
"name": "MSP360 Backup 8.1.1.19",
"product_id": "CSAFPID-0004"
}
}
],
"category": "product_name",
"name": "Backup"
}
],
"category": "vendor",
"name": "MSP360"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Matthew Galligan"
]
}
],
"cve": "CVE-2025-43595",
"cwe": {
"id": "CWE-276",
"name": "Incorrect Default Permissions"
},
"notes": [
{
"category": "summary",
"text": "An insecure file system permissions vulnerability in MSP360 Backup (for Linux) 4.3.1.115 allows a low privileged user to execute commands with root privileges in the \u0027Online Backup\u0027 directory. Upgrade to MSP360 Backup 4.4 (released on 2025-04-22).",
"title": "Description"
},
{
"category": "details",
"text": "SSVCv2/E:P/A:N/T:T/2025-05-01T20:45:18Z/",
"title": "SSVC"
}
],
"product_status": {
"fixed": [
"CSAFPID-0002"
],
"known_affected": [
"CSAFPID-0001"
]
},
"references": [
{
"category": "external",
"summary": "help.msp360.com",
"url": "https://help.msp360.com/cloudberry-backup-mac-linux/whats-new"
},
{
"category": "external",
"summary": "CISA VA-25-119-01 CSAF",
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-119-01.json"
},
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43595"
}
],
"release_date": "2025-04-22T00:00:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-04-22T00:00:00Z",
"details": "Upgrade to MSP360 Backup 4.4.",
"product_ids": [
"CSAFPID-0001"
],
"url": "https://help.msp360.com/cloudberry-backup-mac-linux/whats-new"
},
{
"category": "vendor_fix",
"date": "2025-04-22T00:00:00Z",
"details": "Upgrade to MSP360 Backup 4.4.",
"product_ids": [
"CSAFPID-0002"
],
"url": "https://help.msp360.com/cloudberry-backup-mac-linux/whats-new"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "MSP360 Backup (for Linux) insecure filesystem permissions"
},
{
"acknowledgments": [
{
"names": [
"Matthew Galligan"
]
}
],
"cve": "CVE-2025-43596",
"cwe": {
"id": "CWE-276",
"name": "Incorrect Default Permissions"
},
"notes": [
{
"category": "summary",
"text": "An insecure file system permissions vulnerability in MSP360 Backup (for Windows) 8.0 allows a low privileged user to execute commands with SYSTEM privileges. Upgrade to MSP360 Backup 8.1.1.19 (released on 2025-05-15).",
"title": "Description"
},
{
"category": "details",
"text": "SSVCv2/E:P/A:N/T:T/2025-04-16T19:03:28Z/",
"title": "SSVC"
}
],
"product_status": {
"fixed": [
"CSAFPID-0004"
],
"known_affected": [
"CSAFPID-0003"
]
},
"references": [
{
"category": "external",
"summary": "help.msp360.com",
"url": "https://help.msp360.com/cloudberry-backup/whats-new"
},
{
"category": "external",
"summary": "help.msp360.com",
"url": "https://help.msp360.com/cloudberry-backup/security/admin-privileges"
},
{
"category": "external",
"summary": "CISA VA-25-119-01 CSAF",
"url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-119-01.json"
},
{
"category": "external",
"summary": "www.cve.org",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-43596"
}
],
"release_date": "2025-05-19T00:00:00Z",
"remediations": [
{
"category": "vendor_fix",
"date": "2025-05-15T00:00:00Z",
"details": "Upgrade to MSP360 Backup 8.1.1.19",
"product_ids": [
"CSAFPID-0003"
],
"url": "https://help.msp360.com/cloudberry-backup/whats-new"
},
{
"category": "vendor_fix",
"date": "2025-05-15T00:00:00Z",
"details": "Upgrade to MSP360 Backup 8.1.1.19",
"product_ids": [
"CSAFPID-0004"
],
"url": "https://help.msp360.com/cloudberry-backup/whats-new"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-0003"
]
}
],
"title": "MSP360 Backup (for Windows) insecure filesystem permissions"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…