CVE-2025-43596
📋 TL;DR
An insecure file system permissions vulnerability in MSP360 Backup 8.0 allows low-privileged users to execute arbitrary commands with SYSTEM privileges by exploiting specially crafted backup target files. This affects all systems running vulnerable versions of MSP360 Backup, enabling privilege escalation from standard user accounts to full system control.
💻 Affected Systems
- MSP360 Backup (formerly CloudBerry Backup)
📦 What is this software?
Backup by Msp360
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining persistent SYSTEM-level access, installing malware, stealing sensitive data, and pivoting to other systems in the network.
Likely Case
Privilege escalation from standard user to SYSTEM, allowing installation of backdoors, credential theft, and lateral movement within the network.
If Mitigated
Limited impact if proper access controls restrict low-privileged users from accessing backup functionality and file system locations.
🎯 Exploit Status
Requires authenticated low-privileged access. Exploitation involves creating specially crafted backup target files to trigger privilege escalation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.1.1.19
Vendor Advisory: https://help.msp360.com/cloudberry-backup/whats-new
Restart Required: Yes
Instructions:
1. Download MSP360 Backup 8.1.1.19 from official vendor sources. 2. Run the installer as administrator. 3. Follow installation prompts. 4. Restart the system after installation completes.
🔧 Temporary Workarounds
Restrict Backup Permissions
windowsLimit backup configuration and file system access to administrative users only
Use Windows Group Policy to restrict access to MSP360 Backup directories and executables to administrators only
Disable Low-Privileged Backup Access
windowsPrevent non-administrative users from configuring or running backups
Remove backup permissions from standard user accounts in MSP360 Backup settings
🧯 If You Can't Patch
- Implement strict access controls to ensure only trusted administrators can configure or modify backup settings
- Monitor file system changes in backup target directories and alert on suspicious file creations or modifications
🔍 How to Verify
Check if Vulnerable:
Check MSP360 Backup version in Help > About. If version is 8.0.x and less than 8.1.1.19, the system is vulnerable.Check Version:
Check application version via GUI (Help > About) or registry: HKEY_LOCAL_MACHINE\SOFTWARE\MSP360\Backup\VersionVerify Fix Applied:
Verify version shows 8.1.1.19 or higher in Help > About after patching.📡 Detection & Monitoring
Log Indicators:
- Unusual backup job creations or modifications by non-admin users
- File creation events in backup target directories from low-privileged accounts
- Process creation events showing MSP360 Backup spawning unexpected child processes
Network Indicators:
- Unusual outbound connections from backup server following backup job execution
SIEM Query:
EventID=4688 AND NewProcessName LIKE '%MSP360%' AND SubjectUserName NOT IN (admin_users_list)