Read the docs
TI-2025-35621 Aliases CVE-2025-57714GHSA-5vw3-9mwr-56v3

An unquoted search path or element vulnerability has been reported to affect NetBak…

Priority LOW 38CWE-428Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-428.

Summary

An unquoted search path or element vulnerability has been reported to affect NetBak Replicator. If a local attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: NetBak Replicator 4.5.15.0807 and later

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0021 11th percentileScored 2026-11-07
Fix Fixed NetBak Replicator (QNAP Systems Inc.): 4.5.15.0807

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
QNAPNetBak Replicator4.5.x to before 4.5.15.08074.5.15.0807Patch availableCNA
  • NetBak Replicator VendorQNAP Affected 4.5.x to before 4.5.15.0807 Fixed in 4.5.15.0807 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:qnap:netbak_replicator:*:*:*:*:*:*:*:*4.5.0.0209 to before 4.5.15.0807VulnerableQNAP
  • cpe:2.3:a:qnap:netbak_replicator:*:*:*:*:*:*:*:* Versions 4.5.0.0209 to before 4.5.15.0807 Vulnerable ·QNAP

Remediation

  • Fix · CNA NetBak Replicator (QNAP Systems Inc.) Fixed in 4.5.15.0807

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-57714
  2. 2026-10-03 Alias added: GHSA-5vw3-9mwr-56v3

References

Advisory 1

  • TI-2019-05106 An unquoted service path vulnerability is reported to affect the service QVssService in… CVSS 3.1HIGH 7.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences