CVE-2019-25608: Iperius Backup Privilege Escalation Flaw

CVE-2019-25608 Overview

CVE-2019-25608 is a privilege escalation vulnerability affecting Iperius Backup version 6.1.0. This vulnerability allows low-privilege users to execute arbitrary programs with elevated privileges by creating backup jobs. Attackers can configure backup jobs to execute malicious batch files or programs before or after backup operations, which run with the privileges of the Iperius Backup Service account (typically Local System or Administrator), enabling privilege escalation and arbitrary code execution.

Critical Impact

Local attackers with limited privileges can escalate to SYSTEM-level access by abusing the backup job configuration functionality, leading to complete system compromise.

Affected Products

• Iperius Backup 6.1.0

Discovery Timeline

• 2026-03-22 - CVE CVE-2019-25608 published to NVD
• 2026-03-23 - Last updated in NVD database

Technical Details for CVE-2019-25608

Vulnerability Analysis

This vulnerability is classified under CWE-520 (Device Driver Not Following Spec), though the core issue relates to improper privilege management in the backup job execution workflow. The Iperius Backup application allows users to configure pre-backup and post-backup scripts or programs that execute automatically when a backup job runs. The critical flaw is that these configured scripts execute with the privileges of the Iperius Backup Service, which typically runs as Local System or an Administrator account.

A low-privileged local user can create or modify backup jobs to include malicious executable files or batch scripts in the pre-backup or post-backup execution fields. When the backup job executes, the malicious payload runs with elevated privileges, effectively bypassing normal privilege boundaries and allowing arbitrary code execution as SYSTEM.

Root Cause

The root cause of this vulnerability is the failure to properly validate and restrict which users can configure program execution within backup jobs, combined with the service running with excessive privileges. The application does not implement adequate access controls to prevent low-privilege users from configuring backup jobs with arbitrary executable paths. Additionally, the service executes these user-specified programs without dropping privileges or implementing sandboxing.

Attack Vector

This is a local attack vector that requires the attacker to have some form of authenticated access to the system where Iperius Backup is installed. The attack flow involves:

1. The attacker creates a malicious batch file or executable that performs privileged operations (e.g., adding a new administrator user, executing a reverse shell)
2. The attacker configures a backup job within Iperius Backup, specifying the malicious file to run before or after the backup operation
3. When the backup job executes (either manually triggered or on schedule), the Iperius Backup Service runs the malicious payload with its elevated privileges
4. The attacker achieves privilege escalation from their low-privilege account to SYSTEM or Administrator level

The vulnerability is particularly dangerous in shared computing environments or scenarios where multiple users have access to a system running Iperius Backup. Technical details and proof-of-concept information can be found at the Exploit-DB #46863 entry.

Detection Methods for CVE-2019-25608

Indicators of Compromise

• Unexpected or unauthorized backup job configurations, particularly those with pre-backup or post-backup scripts
• Suspicious batch files (.bat, .cmd) or executables in user-writable directories being referenced by the Iperius Backup service
• Process execution events showing the Iperius Backup service spawning unusual child processes
• New administrator accounts or privilege changes occurring shortly after backup job execution times

Detection Strategies

• Monitor Windows Event Logs for process creation events (Event ID 4688) where the parent process is the Iperius Backup service and the child process is in an unexpected location
• Implement file integrity monitoring on Iperius Backup configuration files and directories
• Use endpoint detection tools to alert on privilege escalation patterns, such as low-privilege user actions resulting in SYSTEM-level process execution
• Audit backup job configurations periodically for unauthorized or suspicious script references

Monitoring Recommendations

• Enable detailed process auditing and command-line logging in Windows Security Event Logs
• Deploy SentinelOne endpoint protection to detect and respond to suspicious privilege escalation behavior and unauthorized process spawning
• Implement least-privilege access controls limiting which users can configure backup jobs in Iperius Backup
• Monitor for modifications to backup job configuration files and registry keys associated with Iperius Backup

How to Mitigate CVE-2019-25608

Immediate Actions Required

• Review all existing backup job configurations in Iperius Backup and remove any unauthorized or suspicious pre-backup/post-backup scripts
• Restrict access to the Iperius Backup application interface to only trusted administrator accounts
• Consider temporarily disabling the pre-backup and post-backup script functionality if not operationally required
• Audit user accounts and privileges on affected systems for signs of compromise

Patch Information

Users should upgrade Iperius Backup to the latest available version from the official download page. Review the VulnCheck Advisory on Iperius Backup for additional remediation guidance and updated version information.

Workarounds

• Implement file system permissions to prevent low-privilege users from placing executable files in directories that could be referenced by backup jobs
• Configure Windows Software Restriction Policies or AppLocker to block script and executable execution from user-writable directories
• Run the Iperius Backup Service with a dedicated low-privilege service account instead of Local System (note: this may impact backup functionality)
• Use Group Policy to restrict which users can access and configure the Iperius Backup application

# Example: Restrict access to Iperius Backup configuration directory
# Run in an elevated PowerShell session
icacls "C:\ProgramData\Iperius Backup" /inheritance:r /grant:r "BUILTIN\Administrators:(OI)(CI)F" /grant:r "NT AUTHORITY\SYSTEM:(OI)(CI)F"