NetBak Replicator CVE-2025-57714

Exploitation requires a pre-existing authenticated local user account on the Windows host running NetBak Replicator (PR:L, AV:L) and the ability to write a malicious executable into a directory that precedes the intended binary along an unquoted service/application path. Limiting factors: there is no remote vector and no network reachability (local only), the attacker must already have a foothold on the machine, and the vulnerable path is resolved only when the affected service/process starts (or restarts/reboots), so execution is not instantaneous. Only installations running versions 4.5.x below 4.5.15.0807 are affected; patched builds (4.5.15.0807+) remove the condition.

The vendor-assigned CVSS 4.0 base score is 8.5 (High), but the vector itself tells a more restrained story: AV:L (local attack vector), AC:L, AT:N, PR:L (requires an existing low-privileged user account), UI:N, with high confidentiality/integrity/availability impact to the vulnerable system (VC:H/VI:H/VA:H) and no subsequent-system impact (SC/SI/SA:N). This is a local privilege/code-execution issue, not a remotely reachable one, which materially lowers real-world urgency despite the High label. Corroborating signals point the same way: EPSS is 0.02% (3rd percentile), there is no CISA KEV listing, and no public proof-of-concept is referenced - so there is no public exploit identified at time of analysis. The CWE (CWE-428, unquoted search path) is consistent with the description's local-user, code-execution framing, so the signals are internally coherent rather than conflicting. Note one metadata problem: the input Tags include 'Authentication Bypass', which is inconsistent with an unquoted-search-path local-code-execution flaw (CWE-428) - treat that tag as erroneous, not as evidence of a second vulnerability class. Net assessment: a legitimate local privilege-escalation bug worth patching on affected Windows hosts, but not an emergency-priority, mass-exploitable vulnerability.

An attacker who already holds a low-privileged local Windows account on a machine running NetBak Replicator places a malicious executable at an unquoted path location that the application's service resolves ahead of the intended binary. When the affected service or process starts (e.g., at boot or service restart), it executes the attacker's binary with the service's privileges, yielding unauthorized code execution. No public proof-of-concept is referenced, and the attack is local (AV:L) requiring a pre-existing foothold.