CVE-2025-8611: RCE in AOMEI Cyber Backup

The impact of CVE-2025-8611 is severe due to the lack of authentication required for exploitation. An attacker can directly access the DaoService on TCP port 9074 and execute commands with SYSTEM privileges. This grants them complete control over the affected machine, enabling them to install malware, steal sensitive data, modify system configurations, and potentially pivot to other systems on the network. The vulnerability's simplicity and lack of authentication make it a high-priority target for malicious actors, particularly those seeking to gain initial access to a network. The potential for widespread compromise is significant, especially in environments where AOMEI Cyber Backup is deployed without proper network segmentation or security controls.

1. Reserved2025-08-05
2. Published2025-08-20
3. EPSS updated2026-03-23

The primary mitigation for CVE-2025-8611 is to immediately upgrade AOMEI Cyber Backup to version 3.7.1 or later. If upgrading is not immediately feasible, consider isolating affected systems from the network to prevent exploitation. Network firewalls can be configured to block inbound traffic to TCP port 9074. While a WAF is unlikely to directly mitigate this vulnerability, it could potentially detect and block malicious requests based on observed patterns. Monitor system logs for suspicious activity related to the DaoService, specifically looking for unauthorized process executions or network connections originating from the 9074 port. After upgrading, confirm the vulnerability is resolved by attempting to access the DaoService without authentication and verifying that access is denied.