EUVD-2026-17966
GHSA-m24f-g88m-9r7h
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A04:2025 - Cryptographic Failures
ASVS 5.0
V11 - Cryptography Key management, no hard-coded keys
|
| Impact | This vulnerability presents low real-world risk despite the existence of publicly available exploit code. The CVSS 4.0 vector indicates attack vector is local (AV:L) with high complexity (AC:H) and low privilege requirement (PR:L), requiring an attacker to first authenticate to the system or operate as a low-privilege user-a significant barrier. The confidentiality impact is limited (VC:L) with no integrity or availability impact (VI:N, VA:N), meaning successful exploitation only discloses stored credentials rather than enabling system compromise or denial of service. The public exploit availability and explicitly documented hard-coded key weakness increase the technical feasibility for local attackers, but the local-only attack vector and authentication requirement substantially limit the attack surface compared to network-accessible vulnerabilities. CISA KEV status is not confirmed in the provided data, and the low CVSS 2.0 score reflects the constrained threat model. Organizations should prioritize patching systems accessible to untrusted local users, but this is not a critical network-facing threat requiring emergency response. |
| Exploit ScenarioDerived | An authenticated local user with low privileges on a system running Iperius Backup 8.7.2 obtains the hard-coded cryptographic key from the application binary or public advisory sources, then uses the publicly available Python proof-of-concept script (available at https://github.com/VulnaraByte/iperius-backup-security-advisories/blob/main/poc/decrypt_iperius.py) to decrypt the IperiusAccounts.ini file and extract stored credentials for cloud backup services, on-premises servers, or other integrated systems. The attacker can then pivot to those external systems using the compromised credentials, escalating their capabilities beyond the local system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 01, 2026
Iperius Backup versions up to 8.7.2 use a hard-coded cryptographic key for IperiusAccounts.ini file encryption, allowing local authenticated attackers with low privileges to decrypt stored credentials and extract sensitive account information. The vulnerability requires high attack complexity and local access, resulting in a CVSS 2.0 score with low confidentiality impact; a publicly available proof-of-concept exploit exists, and vendor-released patch version 8.7.4 fixes the issue.
RemediationAI
Vendor-released patch: Upgrade Iperius Backup to version 8.7.4 or later, which replaces the hard-coded cryptographic key with a properly derived encryption mechanism. The patched version is available for download from the official Iperius Backup website at https://www.iperiusbackup.com/download-software-backup.aspx. For systems unable to upgrade immediately, restrict local access to the IperiusAccounts.ini file and surrounding configuration directories to trusted administrative users only, limit interactive login privileges for non-administrative accounts, and consider using operating system-level credential storage or external key management solutions to protect backup account credentials. Verify the upgrade completion by checking the application version and reviewing the changelog to confirm the cryptographic key implementation has been updated.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Iperius Backup stores user account credentials in an IperiusAccounts.ini configuration file that employs cryptographic encryption to protect sensitive data. However, the encryption implementation relies on a hard-coded symmetric key embedded within the application binary rather than using a derived or user-specific key, which violates fundamental cryptographic practices defined in CWE-321 (Use of Hard-coded Cryptographic Key). This allows any local user with sufficient privileges to access and decrypt the configuration file using the known key, bypassing the intended protection mechanism. The vulnerability affects Iperius Backup across all versions up to 8.7.2 (CPE: cpe:2.3:a:enter_software:iperius_backup:*:*:*:*:*:*:*:*), with the hard-coded key weakness being the root cause that enables credential extraction from the IperiusAccounts.ini file.
Know when Iperius Backup gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was identified in Enter Software Iperius Backup up to 8.7.2. This impacts an unknown function of the file IperiusAccounts.ini. Such manipulation leads to use of hard-coded cryptographic key . The attack must be carried out locally. This attack is characterized by high complexity. The exploitability is said to be difficult. The exploit is publicly available and might be used. Upgrading to version 8.7.4 will fix this issue. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Iperius Backup
View allIperius Backup 5.8.1 contains a local buffer overflow vulnerability in the structured exception handling (SEH) mechanism
Iperius Backup 6.1.0 contains a privilege escalation vulnerability that allows low-privilege users to execute arbitrary
Iperius Backup 8.7.3 creates temporary files with insecure permissions in the Backup Service component, allowing local a
Improper privilege management in Iperius Backup through version 8.7.3 allows local authenticated attackers to escalate p
A local information disclosure vulnerability exists in Enter Software Iperius Backup versions up to 8.7.3 within the NTL
Exploit-DB