CVE-2024-48248

🔥 Known Exploited (CISA KEV)HIGH

8.6

CVSS Severity Score

EPSS Score0.0000%

EPSS Percentile0.00th

Published2025-03-04

Last Modified2026-06-17

Data SourcesNVDCISA KEV

Vulnerability Description

NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router (this may lead to remote code execution across the enterprise because PhysicalDiscovery has cleartext credentials).

Affected Platforms (CPE)

📦

Nakivo

Backup \& Replication Director

< 11.0.0.88174

References & Advisories

🔗 https://helpcenter.nakivo.com/Release-Notes/Content/Release-Notes.htm

🔗 https://labs.watchtowr.com/the-best-security-is-when-we-all-agree-to-keep-everything-secret-except-the-secrets-nakivo-backup-replication-cve-2024-48248/

🔗 https://github.com/watchtowrlabs/nakivo-arbitrary-file-read-poc-CVE-2024-48248/?ref=labs.watchtowr.com

🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-48248

Vulnerability Description

Affected Platforms (CPE)

Backup \& Replication Director

References & Advisories

相關漏洞威脅