A critical vulnerability identified as CVE-2024-48248 in Nakivo Backup & Replication allows for unauthenticated arbitrary file reads, potentially leading to sensitive data exposure. Despite the severity, Nakivo was initially unresponsive and later resolved the issue silently, compromising transparency. The lack of a public advisory continued to leave many systems at risk. Discovered by watchTowr Labs, this flaw affects numerous versions and has been found in over 200 instances globally, with significant concentrations in France and the United States. The vulnerability provides attackers access to crucial system files and backup data, posing a high risk of data breach and infrastructure compromise.
Source: https://cybersecuritynews.com/nakivo-backup-replication-tool-vulnerability/
"id": "nak408030225",
"linkid": "nakivo",
"type": "Vulnerability",
"date": "2/2025",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization’s existence"