Netbak Replicator
Monthly
NetBak Replicator 4.5.x on Windows allows an authenticated local user to execute arbitrary code via an unquoted search path, resulting in local privilege escalation. The flaw (CWE-428) affects versions before 4.5.15.0807 and requires an existing low-privileged account; execution occurs when the affected service or process starts or restarts, not instantaneously. No public exploit identified at time of analysis, and EPSS is low at 0.02%, though the vendor rates the issue High with a CVSS 4.0 score of 8.5.
An unquoted service path vulnerability is reported to affect the service QVssService in QNAP NetBak Replicator. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
NetBak Replicator 4.5.x on Windows allows an authenticated local user to execute arbitrary code via an unquoted search path, resulting in local privilege escalation. The flaw (CWE-428) affects versions before 4.5.15.0807 and requires an existing low-privileged account; execution occurs when the affected service or process starts or restarts, not instantaneously. No public exploit identified at time of analysis, and EPSS is low at 0.02%, though the vendor rates the issue High with a CVSS 4.0 score of 8.5.
An unquoted service path vulnerability is reported to affect the service QVssService in QNAP NetBak Replicator. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.