CVE-2024-48248: NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router (this may lead to...
8.6
CVSS
Description
NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router (this may lead to remote code execution across the enterprise because PhysicalDiscovery has cleartext credentials).
Known Exploited
🚨 Marked as known exploited on March 19th, 2025 (about 1 month ago).
Classification
CVE ID: CVE-2024-48248
CVSS Base Severity: HIGH
CVSS Base Score: 8.6
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Affected Products
Vendor: n/a
Product: n/a
Nuclei Template
http/cves/2024/CVE-2024-48248.yaml
Exploit Prediction Scoring System (EPSS)
EPSS Score: 90.8% (probability of being exploited)
EPSS Percentile: 99.61% (scored less or equal to compared to others)
EPSS Date: 2025-04-02 (when was this score calculated)
References
https://nvd.nist.gov/vuln/detail/CVE-2024-48248https://labs.watchtowr.com/the-best-security-is-when-we-all-agree-to-keep-everything-secret-except-the-secrets-nakivo-backup-replication-cve-2024-48248/
https://helpcenter.nakivo.com/Release-Notes/Content/Release-Notes.htm