CVE-2025-8610: RCE in AOMEI Cyber Backup

The impact of CVE-2025-8610 is severe due to the lack of authentication required for exploitation. An attacker can directly access the StorageNode service on TCP port 9075 and execute arbitrary code in the SYSTEM context. This grants them complete control over the affected machine, enabling data theft, malware installation, and lateral movement within the network. The vulnerability's ease of exploitation and high-privilege execution make it a significant threat, particularly in environments where AOMEI Cyber Backup is exposed to external networks or untrusted sources. Successful exploitation could mirror the impact of other RCE vulnerabilities where attackers gain full system control, potentially leading to ransomware deployment or data exfiltration.

1. Reserved2025-08-05
2. Published2025-08-20
3. EPSS updated2026-03-23

The primary mitigation for CVE-2025-8610 is to immediately upgrade AOMEI Cyber Backup to version 3.7.1 or later. If upgrading is not immediately feasible, consider isolating affected systems from external networks to prevent unauthorized access. Network segmentation can limit the potential blast radius of a successful attack. While a direct workaround is unavailable, monitoring TCP port 9075 for unusual activity can provide early detection. After upgrading, confirm the vulnerability is resolved by attempting to access the StorageNode service without authentication; it should be denied.