PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-48248 NAKIVO CVE debrief

CVE-2024-48248 is a NAKIVO Backup and Replication absolute path traversal vulnerability that CISA added to the Known Exploited Vulnerabilities catalog on 2025-03-19. Because it is KEV-listed, organizations should treat remediation as urgent and follow vendor mitigation guidance or CISA-referenced requirements as soon as possible.

Vendor
NAKIVO
Product
Backup and Replication
CVSS
HIGH 8.6
CISA KEV
Listed
Original CVE published
2025-03-19
Original CVE updated
2025-03-19
Advisory published
2025-03-19
Advisory updated
2025-03-19

Who should care

Organizations that run NAKIVO Backup and Replication, especially backup administrators, infrastructure teams, and security operations staff responsible for exposed or business-critical instances.

Technical summary

The supplied corpus identifies CVE-2024-48248 as an absolute path traversal vulnerability in NAKIVO Backup and Replication. The available official source material does not provide a CVSS score, exploit details, or vendor advisory text, but CISA’s KEV listing indicates the issue is known to have been exploited and should be prioritized for remediation.

Defensive priority

Urgent

Recommended defensive actions

  • Inventory all NAKIVO Backup and Replication deployments, including any externally reachable or cloud-hosted instances.
  • Review the vendor release notes and apply the vendor’s mitigations or updates referenced by CISA as soon as they are available.
  • If mitigations are unavailable, follow CISA guidance for the affected deployment model and consider discontinuing use until a safe remediation path exists.
  • Complete remediation before the CISA KEV due date of 2025-04-09 and verify that affected systems remain patched or otherwise protected.

Evidence notes

This debrief is based only on the supplied KEV source item and the official links included in the corpus. The corpus shows CISA added CVE-2024-48248 to the KEV catalog on 2025-03-19 with a due date of 2025-04-09, but it does not include vendor release-note text or a CVSS score.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-48248 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-48248

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-48248 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-48248

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

  • CISA Known Exploited Vulnerabilities catalog

    Publisher, destination, and source semantics verified

    URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

    Cybersecurity and Infrastructure Security Agency - Official CISA catalog of vulnerabilities known to be exploited in the wild.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

    cisa_kev

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.