Summary
MSP360 Backup is a data backup and recovery solution. Insecure file system permission vulnerabilities in both the Windows and Linux versions allow a lower privileged user to execute commands the privileges of other users, including administrative users. An attacker could exploit these vulnerabilities to obtain user credentials, redirect the backup target to obtain the data being backed up, and execute commands with the privileges of other (possibly administrative) users.
Vulnerabilities 2
-
High 7.8
MSP360 Backup (for Linux) insecure filesystem permissions
An insecure file system permissions vulnerability in MSP360 Backup 4.3.1.115 allows a low privileged user to execute commands with root privileges in the 'Online Backup' folder. Upgrade to MSP360 Backup 4.4 (released on 2025-04-22).
-
High 7.8
MSP360 Backup (for Windows) insecure filesystem permissions
An insecure file system permissions vulnerability in MSP360 Backup 8.0 allows a low privileged user to execute commands with SYSTEM level privileges using a specially crafted file with an arbitrary file backup target. Upgrade to MSP360 Backup 8.1.1.19 (releas…
Revision history
-
#2.0.0
Added CVE-2025-43596
-
#1.0.0
Initial publication