Vulnerability Description
An insecure file system permissions vulnerability in MSP360 Backup 8.0 allows a low privileged user to execute commands with SYSTEM level privileges using a specially crafted file with an arbitrary file backup target. Upgrade to MSP360 Backup 8.1.1.19 (released on 2025-05-15).
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Msp360 | Backup | >= 8.0, < 8.1.1.19 |
Related Weaknesses (CWE)
References
- https://help.msp360.com/cloudberry-backup/security/admin-privilegesProduct
- https://help.msp360.com/cloudberry-backup/whats-newRelease Notes
- https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2025-43596Third Party Advisory
FAQ
What is CVE-2025-43596?
CVE-2025-43596 is a vulnerability with a CVSS score of 7.8 (HIGH). An insecure file system permissions vulnerability in MSP360 Backup 8.0 allows a low privileged user to execute commands with SYSTEM level privileges using a specially crafted file with an arbitrary fi...
How severe is CVE-2025-43596?
CVE-2025-43596 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-43596?
Check the references section above for vendor advisories and patch information. Affected products include: Msp360 Backup.