Local Privilege Escalation in MSP360 Free Backup Restore Function

Publication date: 2025-12-23

Last updated on: 2025-12-23

Assigner: Zero Day Initiative

Description

MSP360 Free Backup Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MSP360 Free Backup. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. User interaction on the part of an administrator is needed additionally. The specific flaw exists within the restore functionality. By creating a junction, an attacker can abuse the service to create arbitrary files. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-27245.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-23

Last Modified

2025-12-23

Generated

2026-07-06

AI Q&A

2025-12-24

EPSS Evaluated

2026-07-05

NVD

CVE-2025-12838

Affected Vendors & Products

Vendor	Product	Version / Range
msp360	free_backup	3.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-59	The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

Executive Summary

This vulnerability in MSP360 Free Backup allows a local attacker who can execute low-privileged code and has administrator interaction to escalate their privileges. It exploits a flaw in the restore functionality where an attacker can create a junction to abuse the service into creating arbitrary files, enabling execution of arbitrary code with SYSTEM-level privileges.

Impact Analysis

The vulnerability can allow an attacker to escalate their privileges from a low-privileged user to SYSTEM level, potentially leading to full control over the affected system. This can result in unauthorized code execution, data compromise, and disruption of system operations.

Mitigation Strategies

To mitigate this vulnerability, ensure that only trusted users have the ability to execute code on the system, especially with low privileges. Avoid running the MSP360 Free Backup restore functionality without proper administrative oversight. Monitor and restrict the creation of junctions or symbolic links that could be abused. Additionally, apply any available patches or updates from MSP360 once released and educate administrators to avoid interacting with suspicious restore operations.

Hi! I’m here to help you understand CVE-2025-12838. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70