CISA Adds NAKIVO Vulnerability to KEV Catalog Amid Active Exploitation

CVE-2017-12637 is an unauthenticated directory traversal flaw (CWE-22) in the scheduler UI endpoint scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS of SAP NetWeaver Application Server Java 7.5. A remote attacker triggers it by inserting dot-dot (../) sequences into the query string of that endpoint, causing the server to read files outside the intended directory. Successful exploitation yields arbitrary file disclosure on the server (e.g., configuration files or credentials), with no authentication or user interaction required, consistent with the CVSS 3.1 score of 7.5 (High, network vector, confidentiality-only impact). Organizations running SAP NetWeaver Application Server Java 7.5 are affected, particularly internet-exposed instances such as SAP Enterprise Portal or Process Integration/Orchestration landscapes. The flaw was exploited in the wild as early as August 2017 and addressed via SAP Security Note 2486657; CISA added it to the Known Exploited Vulnerabilities catalog on 2025-03-19, and EPSS currently assigns a 95.1% probability of exploitation within 30 days (100th percentile).

Do: Apply the fix from SAP Security Note 2486657 to affected Application Server Java 7.5 systems; where patching is not yet possible, restrict or block access to the scheduler UI path (scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS) and limit internet exposure of AS Java. Hunt for exploitation by reviewing web logs for dot-dot (../) traversal sequences in query strings targeting that endpoint, and follow CISA BOD 22-01 guidance for cloud services or the KEV required action if mitigations are unavailable.

NAKIVO Backup & Replication before version 11.0.0.88174 contains an absolute path traversal flaw (CWE-36) in the getImageByPath function exposed through the /c/router endpoint, which lets an attacker read arbitrary files from the server. Because the request requires no authentication and no user interaction (CVSS 3.1: 8.6, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), any party that can reach the NAKIVO web interface can send crafted requests to retrieve files. The impact can extend beyond file disclosure: the PhysicalDiscovery function stores credentials in cleartext, so files harvested via the traversal can expose credentials that may enable remote code execution across the enterprise. All organizations running affected versions are at risk, particularly those with the NAKIVO web UI reachable from the internet. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-03-19 amid reports of active exploitation, and EPSS puts its 30-day exploitation probability at roughly 94%.

Do: Upgrade NAKIVO Backup & Replication to version 11.0.0.88174 or later; federal agencies must apply vendor mitigations or follow BOD 22-01 guidance (or discontinue use) within the required timeframe. Until patched, restrict internet exposure of the NAKIVO web interface and /c/router endpoint, review logs for suspicious getImageByPath requests, and rotate credentials configured for PhysicalDiscovery since cleartext credential harvesting may have enabled broader compromise.

CVE-2025-1316 is an OS command injection flaw (CWE-78) in the Edimax IC-7100 IP camera that fails to properly neutralize requests it receives. Because the request handling is reachable over the network without authentication or user interaction (per the CVSS 4.0 vector), an unauthenticated attacker can send specially crafted requests to the device. Successful exploitation yields full remote code execution on the camera, with high impact on confidentiality, integrity, and availability of the device itself. Only deployments using the Edimax IC-7100 camera and its firmware are affected. The flaw is being actively exploited: CISA added it to the Known Exploited Vulnerabilities catalog on 2025-03-19, and public reporting indicates Mirai-based botnets have been exploiting it since roughly a year before its disclosure, making it effectively a zero-day used to recruit cameras into botnets.

Do: Per the CISA KEV required action, apply mitigations per vendor instructions or discontinue use of the IC-7100 if mitigations are unavailable; check whether Edimax has released updated firmware and install it. In the meantime, reduce exposure by removing any port-forwarding or direct internet access to affected cameras, restricting management interfaces to trusted networks, and monitoring for Mirai-like scanning or traffic. Treat exploitation as likely given the high EPSS (74.5% in 30 days) and in-the-wild botnet use.