CISA Adds NAKIVO Backup & Replication Vulnerability to KEV Catalog Due to Active Exploitation

- Reported on March 20, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high-severity vulnerability in NAKIVO Backup & Replication software (CVE-2024-48248) to its Known Exploited Vulnerabilities catalog, citing active exploitation. - This flaw, with a CVSS score of 8.6, allows unauthenticated attackers to exploit an absolute path traversal bug to read sensitive files on the target system. It affects all versions before 10.11.3.86570, and could lead to the exposure of configuration files, backups, and credentials. Although a proof-of-concept exploit was published, the vulnerability was patched in November 2024. - CISA also added two other vulnerabilities to the catalog: CVE-2025-1316, a command injection flaw in Edimax IC-7100 IP cameras, and CVE-2017-12637, a directory traversal issue in SAP NetWeaver. - Both vulnerabilities are under active exploitation, with CVE-2025-1316 being used to target cameras with default credentials for Mirai botnet attacks. Federal agencies are required to apply mitigations by April 9, 2025.