{"id":10978,"date":"2025-03-20T13:44:27","date_gmt":"2025-03-20T13:44:27","guid":{"rendered":"https:\/\/fusionmindlabs.com\/blogs\/cisa-adds-nakivo-to-kev-amid-exploitation\/"},"modified":"2025-03-20T13:44:28","modified_gmt":"2025-03-20T13:44:28","slug":"cisa-adds-nakivo-to-kev-amid-exploitation","status":"publish","type":"post","link":"https:\/\/fusionmindlabs.com\/blogs\/cisa-adds-nakivo-to-kev-amid-exploitation\/","title":{"rendered":"CISA Adds NAKIVO to KEV Amid Exploitation"},"content":{"rendered":"\n<\/p>\n
\n

\ue802<\/i>Mar 20, 2025<\/span>\ue804<\/i>Ravie Lakshmanan<\/span><\/span>Cybersecurity \/ Vulnerability<\/span><\/p>\n<\/div>\n

\n
\n<\/p>\n

<\/a>\n<\/div>\n

The United States Cybersecurity and Infrastructure Security Agency (CISA) has recently added<\/a> a significant security flaw affecting NAKIVO Backup & Replication software to its catalog of Known Exploited Vulnerabilities (KEV), as there is evidence that it is being actively exploited.<\/p>\n

The vulnerability, identified as CVE-2024-48248, has a CVSS score of 8.6 and is an absolute path traversal bug. This allows an unauthenticated attacker to read files on the target host, including sensitive ones like “\/etc\/shadow,” by exploiting the endpoint “\/c\/router.” This issue affects all versions of the software prior to version 10.11.3.86570.<\/p>\n

According to CISA, “NAKIVO Backup and Replication contains an absolute path traversal vulnerability that enables an attacker to read arbitrary files.” This successful exploitation could grant an adversary access to sensitive data, including configuration files, backups, and credentials, potentially leading to further compromises.<\/p>\n

\n

\n
\n\"Cybersecurity\"
\n<\/a>
\n<\/center>\n<\/div>\n

Although there are currently no details available on how this vulnerability is being exploited in the wild, it is worth noting that watchTowr Labs published<\/a> a proof-of-concept (PoC) exploit towards the end of last month. The issue has been addressed<\/a> as of November 2024 with version v11.0.0.88174.<\/p>\n

The cybersecurity firm further noted that the unauthenticated arbitrary file read vulnerability could be used to obtain all stored credentials utilized by the target NAKIVO solution, hosted on the database “product01.h2.db.”<\/p>\n

Two other flaws have also been added to the KEV catalog:<\/p>\n