An insecure file system permissions vulnerability in MSP360 Backup 4.3.1.115 allows a low privileged user to execute commands with root privileges in the ‘Online Backup’ folder. Users are advised to upgrade to MSP360 Backup 4.4, which was released on April 22, 2025, to mitigate this issue.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.5 | CVE-2025-43595 |
Exploitation
To exploit this vulnerability, an attacker with low privileges can access the ‘Online Backup’ folder and execute commands that require root privileges. This can lead to unauthorized access and manipulation of sensitive data.
Affected Products
- MSP360 Backup 4.3.1.115: This version contains the vulnerability that allows low privileged users to gain root access.
- MSP360 Backup 4.4: This version addresses the vulnerability and should be used to ensure security.
Mitigation
To mitigate this vulnerability, users should upgrade to MSP360 Backup 4.4 as soon as possible. This update resolves the insecure file system permissions issue and prevents unauthorized command execution.