SB2025080750 - Multiple vulnerabilities in AOMEI Cyber Backu

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Missing Authentication for Critical Function (CVE-ID: CVE-2025-8611)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to missing authentication for critical function within the DaoService service. A remote attacker can execute arbitrary code on the system.

2) Missing Authentication for Critical Function (CVE-ID: CVE-2025-8610)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to missing authentication for critical function within the StorageNode service. A remote attacker can execute arbitrary code on the system.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

• https://www.zerodayinitiative.com/advisories/ZDI-25-807/
• https://www.zerodayinitiative.com/advisories/ZDI-25-808/