CyberSec.Space Logo
Back to CVE Browser

CVE-2024-48248

🔥 Known Exploited (CISA KEV)HIGH
8.6
CVSS Severity Score
EPSS Score0.0000%
EPSS Percentile0.00th
Published2025-03-04
Last Modified2026-06-17
Data SourcesNVDCISA KEV

Vulnerability Description

NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router (this may lead to remote code execution across the enterprise because PhysicalDiscovery has cleartext credentials).

Affected Platforms (CPE)

📦
Nakivo

Backup \& Replication Director

< 11.0.0.88174

References & Advisories

🔗 https://helpcenter.nakivo.com/Release-Notes/Content/Release-Notes.htm
🔗 https://labs.watchtowr.com/the-best-security-is-when-we-all-agree-to-keep-everything-secret-except-the-secrets-nakivo-backup-replication-cve-2024-48248/
🔗 https://github.com/watchtowrlabs/nakivo-arbitrary-file-read-poc-CVE-2024-48248/?ref=labs.watchtowr.com
🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-48248

Related Vulnerabilities

CVE-2026-642878.2

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU f...

CVE-2026-657118.6

sysPass through version 3.2.11 contains an OS command injection vulnerability that allows authenticated administrators to execute ...

CVE-2026-610947.2

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions tha...

CVE-2026-607476.2

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions tha...