CVE-2025-12838
Unknown Unknown - Not Provided
Local Privilege Escalation in MSP360 Free Backup Restore Function

Publication date: 2025-12-23

Last updated on: 2025-12-23

Assigner: Zero Day Initiative

Description
MSP360 Free Backup Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MSP360 Free Backup. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. User interaction on the part of an administrator is needed additionally. The specific flaw exists within the restore functionality. By creating a junction, an attacker can abuse the service to create arbitrary files. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-27245.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-12-23
Last Modified
2025-12-23
Generated
2026-06-16
AI Q&A
2025-12-24
EPSS Evaluated
2026-06-14
NVD
CVE-2025-12838
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
msp360 free_backup 3.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability in MSP360 Free Backup allows a local attacker who can execute low-privileged code and has administrator interaction to escalate their privileges. It exploits a flaw in the restore functionality where an attacker can create a junction to abuse the service into creating arbitrary files, enabling execution of arbitrary code with SYSTEM-level privileges.

Impact Analysis

The vulnerability can allow an attacker to escalate their privileges from a low-privileged user to SYSTEM level, potentially leading to full control over the affected system. This can result in unauthorized code execution, data compromise, and disruption of system operations.

Mitigation Strategies

To mitigate this vulnerability, ensure that only trusted users have the ability to execute code on the system, especially with low privileges. Avoid running the MSP360 Free Backup restore functionality without proper administrative oversight. Monitor and restrict the creation of junctions or symbolic links that could be abused. Additionally, apply any available patches or updates from MSP360 once released and educate administrators to avoid interacting with suspicious restore operations.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-12838. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart