Vembu BDRSuite CVE-2025-71452

Exploitation targets the templates/progress/clientside/restoreprogress.sgp endpoint of Vembu BDRSuite versions before 7.6.0, where the request parameters mn, rnm, isRepliRestore, rusr, and rpwd are reflected into the HTML response without sanitization. No authentication is required to craft the request (PR:N), but exploitation is gated by required user interaction: a BDRSuite interface user must open the attacker-crafted link (UI:A) for the payload to execute. Impact is limited to the victim's browser context (session hijacking, interface manipulation) rather than the server, and installations updated to 7.6.0 or later are not affected.

This is a moderate, not high-priority, issue. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A) scores 5.1 (medium): network-reachable and unauthenticated (PR:N), but it explicitly requires active user interaction (UI:A) - a victim must open an attacker-crafted link - and the impact is confined to the subsequent (browser) system as SC:L/SI:L with no impact on the vulnerable server itself (VC:N/VI:N/VA:N). No EPSS score, no CISA KEV listing, and no SSVC decision framework were provided in the input; the only prioritization signal present is the vuln.today Decision label of 'this_month' (not act_now/emergency), which is consistent with a reflected XSS that needs social engineering to land. Public references exist (an independent research writeup on chocapikk.com and a VulnCheck advisory), so proof-of-concept detail is plausibly published, but the input does not mark any PoC as confirmed working exploit code. Net: real but bounded risk - a reflected XSS requiring a tricked user, appropriate for scheduled patching rather than emergency response. Missing data to note explicitly: no EPSS and no KEV status were supplied, so exploitation probability cannot be quantified from this input.

An attacker crafts a URL to the BDRSuite restoreprogress.sgp endpoint with a malicious JavaScript payload placed in one of the reflected parameters (mn, rnm, isRepliRestore, rusr, or rpwd) and lures a BDRSuite console user into clicking it. Because the parameters are reflected into the HTML response without sanitization, the script executes in the victim's browser session, enabling session hijacking or manipulation of the backup-management interface. A public PoC reference exists; it is not verified as working exploit code, and successful exploitation depends on the victim opening the attacker-supplied link (UI:A).