AOMEI Cyber Backup Missing Authentication for Critical Function Remote Code Execution Vulnerability

The impact of CVE-2025-8610 is severe due to the lack of authentication required for exploitation. An attacker can directly access the StorageNode service on TCP port 9075 and execute arbitrary code in the SYSTEM context. This grants them complete control over the affected machine, enabling data theft, malware installation, and lateral movement within the network. The vulnerability's ease of exploitation and high-privilege execution make it a significant threat, particularly in environments where AOMEI Cyber Backup is exposed to external networks or untrusted sources. Successful exploitation could mirror the impact of other RCE vulnerabilities where attackers gain full system control, potentially leading to ransomware deployment or data exfiltration.

Organizations utilizing AOMEI Cyber Backup, particularly those with internet-facing deployments or those lacking robust network segmentation, are at significant risk. Shared hosting environments where multiple users share the same server instance are also particularly vulnerable, as a compromise of one user's instance could potentially lead to the compromise of others.

• windows / supply-chain:

Get-Process -Name CyberBackupStorageNode -ErrorAction SilentlyContinue | Select-Object ProcessId, CommandLine

• windows / supply-chain:

Get-WinEvent -LogName System -FilterXPath "*[System[Provider[@Name='Microsoft-Windows-Sysmon/Operational'] and (EventID=1 or EventID=3)] and EventData[Data[@Name='Image']='C:\Program Files\AOMEI Cyber Backup\StorageNode\CyberBackupStorageNode.exe']"] -MaxEvents 10

• generic web: Use a network scanner to check if TCP port 9075 is open on systems running AOMEI Cyber Backup.

1. 2025-08-20Disclosure

   disclosure

2. 2025-08-20Patch

   patch

1. Reserviert2025-08-05
2. Veröffentlicht2025-08-20
3. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-8610 is to immediately upgrade AOMEI Cyber Backup to version 3.7.1 or later. If upgrading is not immediately feasible, consider isolating affected systems from external networks to prevent unauthorized access. Network segmentation can limit the potential blast radius of a successful attack. While a direct workaround is unavailable, monitoring TCP port 9075 for unusual activity can provide early detection. After upgrading, confirm the vulnerability is resolved by attempting to access the StorageNode service without authentication; it should be denied.