An insecure file system permissions vulnerability in MSP360 Backup 4.3.1.115 allows a low privileged user to execute commands with root privileges in the ‘Online Backup’ folder. Users are advised to upgrade to MSP360 Backup 4.4, which was released on April 22, 2025, to mitigate this issue.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.5 | CVE-2025-43595 |
Exploitation
To exploit this vulnerability, an attacker with low privileges can access the ‘Online Backup’ folder in MSP360 Backup 4.3.1.115 and execute commands that will grant them root privileges, potentially compromising the system’s integrity and confidentiality.
Affected Products
- MSP360 Backup 4.3.1.115: This version contains the vulnerability that allows low privileged users to execute commands with elevated privileges.
- MSP360 Backup 4.4: This version addresses the vulnerability and should be used to ensure security.
Mitigation
To mitigate this vulnerability, users should upgrade to MSP360 Backup 4.4, which resolves the insecure file system permissions issue. Regularly updating software and monitoring for security patches is essential to maintain system integrity.