CVE-2024-48248

HighCVSS 8.6/10Known exploited (CISA KEV)Last modified Sep 24, 2026

Description

NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router (this may lead to remote code execution across the enterprise because PhysicalDiscovery has cleartext credentials).

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-36

Affected software

Vendor	Product	Versions
NAKIVO	Backup & Replication Director	< 11.0.0.88174

References

https://helpcenter.nakivo.com/Release-Notes/Content/Release-Notes.htmProduct
https://labs.watchtowr.com/the-best-security-is-when-we-all-agree-to-keep-everything-secret-except-the-secrets-nakivo-backup-replication-cve-2024-48248/Third Party Advisory
https://github.com/watchtowrlabs/nakivo-arbitrary-file-read-poc-CVE-2024-48248/?ref=labs.watchtowr.comExploit, Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-48248US Government Resource

Timeline

Published: Mar 4, 2025
Last modified: Sep 24, 2026
Added to CISA KEV: Mar 19, 2025
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-482497.3Wavelog 1.8.5 allows Gridmap_model.php get_band_confirmed SQL injection via band, sat, propagation, or mode.CVE-2024-48259.8A vulnerability has been discovered in Agentejo Cockpit CMS v0.5.5 that consists in an arbitrary file upload in ‘/media/api’ parameter via p CVE-2024-482519.8Wavelog 1.8.5 allows Activated_gridmap_model.php get_band_confirmed SQL injection via band, sat, propagation, or mode.CVE-2024-482539.8Cloudlog 2.6.15 allows Oqrs.php delete_oqrs_line id SQL injection.CVE-2024-482559.8Cloudlog 2.6.15 allows Oqrs.php get_station_info station_id SQL injection.CVE-2024-482579.8Wavelog 1.8.5 allows Oqrs_model.php get_worked_modes station_id SQL injectioin.CVE-2024-482597.3Cloudlog 2.6.15 allows Oqrs.php request_form SQL injection via station_id or callsign.CVE-2024-48269.8SQL injection vulnerability in Simple PHP Shopping Cart affecting version 0.9. This vulnerability could allow an attacker to retrieve all th CVE-2024-482707.5An issue in the component /logins of oasys v1.1 allows attackers to access sensitive information via a burst attack.CVE-2024-482718.8D-Link DSL6740C v6.TR069.20211230 was discovered to use insecure default credentials for Administrator access, possibly allowing attackers t CVE-2024-482726.5D-Link DSL6740C v6.TR069.20211230 was discovered to use an insecure default Wifi password, possibly allowing attackers to connect to the dev CVE-2024-482785.5Phpgurukul User Registration & Login and User Management System 3.2 is vulnerable to Cross Site Request Forgery (CSRF) via /edit-profile.php