EUVD-2026-17966
GHSA-m24f-g88m-9r7h
Severity by source
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
A vulnerability was identified in Enter Software Iperius Backup up to 8.7.2. This impacts an unknown function of the file IperiusAccounts.ini. Such manipulation leads to use of hard-coded cryptographic key . The attack must be carried out locally. This attack is characterized by high complexity. The exploitability is said to be difficult. The exploit is publicly available and might be used. Upgrading to version 8.7.4 will fix this issue. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
AnalysisAI
Iperius Backup versions up to 8.7.2 use a hard-coded cryptographic key for IperiusAccounts.ini file encryption, allowing local authenticated attackers with low privileges to decrypt stored credentials and extract sensitive account information. The vulnerability requires high attack complexity and local access, resulting in a CVSS 2.0 score with low confidentiality impact; a publicly available proof-of-concept exploit exists, and vendor-released patch version 8.7.4 fixes the issue.
Technical ContextAI
Iperius Backup stores user account credentials in an IperiusAccounts.ini configuration file that employs cryptographic encryption to protect sensitive data. However, the encryption implementation relies on a hard-coded symmetric key embedded within the application binary rather than using a derived or user-specific key, which violates fundamental cryptographic practices defined in CWE-321 (Use of Hard-coded Cryptographic Key). This allows any local user with sufficient privileges to access and decrypt the configuration file using the known key, bypassing the intended protection mechanism. The vulnerability affects Iperius Backup across all versions up to 8.7.2 (CPE: cpe:2.3:a:enter_software:iperius_backup:*:*:*:*:*:*:*:*), with the hard-coded key weakness being the root cause that enables credential extraction from the IperiusAccounts.ini file.
RemediationAI
Vendor-released patch: Upgrade Iperius Backup to version 8.7.4 or later, which replaces the hard-coded cryptographic key with a properly derived encryption mechanism. The patched version is available for download from the official Iperius Backup website at https://www.iperiusbackup.com/download-software-backup.aspx. For systems unable to upgrade immediately, restrict local access to the IperiusAccounts.ini file and surrounding configuration directories to trusted administrative users only, limit interactive login privileges for non-administrative accounts, and consider using operating system-level credential storage or external key management solutions to protect backup account credentials. Verify the upgrade completion by checking the application version and reviewing the changelog to confirm the cryptographic key implementation has been updated.
More in Iperius Backup
View allIperius Backup 5.8.1 contains a local buffer overflow vulnerability in the structured exception handling (SEH) mechanism
Iperius Backup 6.1.0 contains a privilege escalation vulnerability that allows low-privilege users to execute arbitrary
Iperius Backup 8.7.3 creates temporary files with insecure permissions in the Backup Service component, allowing local a
Improper privilege management in Iperius Backup through version 8.7.3 allows local authenticated attackers to escalate p
A local information disclosure vulnerability exists in Enter Software Iperius Backup versions up to 8.7.3 within the NTL
Same weakness CWE-321 – Use of Hard-coded Cryptographic Key
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today