CVE-2025-12247

A weakness has been identified in Hasleo Backup Suite up to 5.2. Impacted is an unknown function of the component HasleoImageMountService/HasleoBackupSuiteService. This manipulation causes unquoted search path. The attack is restricted to local execution. The attack's complexity is rated as high. The exploitability is considered difficult. The exploit has been made available to the public and could be exploited. Upgrading the affected component is advised.

CVSS v3 7.0 HIGH
CVSS v2.0 6.0 MEDIUM

7.0^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.0 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:H/Au:S/C:C/I:C/A:C

Exploitability : 1.5 / Impact : 10.0

Access Vector LOCAL

Access Complexity HIGH

Authentication SINGLE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://github.com/lakshayyverma/CVE-Discovery/blob/main/Halseo%20Backupservice.md
https://github.com/lakshayyverma/CVE-Discovery/blob/main/Hasleo%20Backup%20Suite%20ImageMountService.md
https://vuldb.com/?ctiid.329918
https://vuldb.com/?id.329918
https://vuldb.com/?submit.672548
https://vuldb.com/?submit.672549
https://www.easyuefi.com/backup-software/downloads/Hasleo_Backup_Suite_Free.exe

Configurations

No configuration.

History

08 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) Se ha identificado una debilidad en Hasleo Backup Suite hasta la versión 5.2. Se ve afectada una función desconocida del componente HasleoImageMountService/HasleoBackupSuiteService. Esta manipulación causa una ruta de búsqueda sin comillas. El ataque está restringido a la ejecución local. La complejidad del ataque se califica como alta. La explotabilidad se considera difícil. El exploit se ha hecho público y podría ser explotado. Se aconseja actualizar el componente afectado.

Information

Published : 2025-10-27 08:15

Updated : 2026-10-08 11:10

NVD link : CVE-2025-12247

Mitre link : CVE-2025-12247

CVE.ORG link : CVE-2025-12247

JSON object : View

Products Affected

No product.

CWE

CWE-426

Untrusted Search Path

CWE-428

Unquoted Search Path or Element

{"id": "CVE-2025-12247", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12247", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-10-27T17:15:29.471103Z"}}], "cvssMetricV2": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"version": "2.0", "baseScore": 6.0, "accessVector": "LOCAL", "vectorString": "AV:L/AC:H/Au:S/C:C/I:C/A:C", "authentication": "SINGLE", "integrityImpact": "COMPLETE", "accessComplexity": "HIGH", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 1.5, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.0, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.0}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.4, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@vuldb.com", "affectedData": [{"vendor": "Hasleo", "modules": ["HasleoImageMountService/HasleoBackupSuiteService"], "product": "Backup Suite", "versions": [{"status": "affected", "version": "5.0"}, {"status": "affected", "version": "5.1"}, {"status": "affected", "version": "5.2"}]}]}], "published": "2025-10-27T08:15:37.343", "references": [{"url": "https://github.com/lakshayyverma/CVE-Discovery/blob/main/Halseo%20Backupservice.md", "source": "cna@vuldb.com"}, {"url": "https://github.com/lakshayyverma/CVE-Discovery/blob/main/Hasleo%20Backup%20Suite%20ImageMountService.md", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/?ctiid.329918", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/?id.329918", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/?submit.672548", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/?submit.672549", "source": "cna@vuldb.com"}, {"url": "https://www.easyuefi.com/backup-software/downloads/Hasleo_Backup_Suite_Free.exe", "source": "cna@vuldb.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-426"}, {"lang": "en", "value": "CWE-428"}]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in Hasleo Backup Suite up to 5.2. Impacted is an unknown function of the component HasleoImageMountService/HasleoBackupSuiteService. This manipulation causes unquoted search path. The attack is restricted to local execution. The attack's complexity is rated as high. The exploitability is considered difficult. The exploit has been made available to the public and could be exploited. Upgrading the affected component is advised."}, {"lang": "es", "value": "Se ha identificado una debilidad en Hasleo Backup Suite hasta la versi\u00f3n 5.2. Se ve afectada una funci\u00f3n desconocida del componente HasleoImageMountService/HasleoBackupSuiteService. Esta manipulaci\u00f3n causa una ruta de b\u00fasqueda sin comillas. El ataque est\u00e1 restringido a la ejecuci\u00f3n local. La complejidad del ataque se califica como alta. La explotabilidad se considera dif\u00edcil. El exploit se ha hecho p\u00fablico y podr\u00eda ser explotado. Se aconseja actualizar el componente afectado."}], "lastModified": "2026-10-08T11:10:00.250", "sourceIdentifier": "cna@vuldb.com"}