CVE-2025-8612 Overview
CVE-2025-8612 is a local privilege escalation vulnerability in AOMEI Backupper Workstation. The flaw resides in the product's restore functionality, which fails to validate filesystem links before writing files. An attacker with low-privileged code execution can create a junction to abuse the service and produce arbitrary files. Successful exploitation grants code execution in the context of SYSTEM. The issue is tracked as ZDI-CAN-27059 and classified under [CWE-59] (Link Following).
Critical Impact
Local attackers can escalate from a low-privileged account to SYSTEM by leveraging a junction against the restore service, provided an administrator triggers the restore operation.
Affected Products
- AOMEI Backupper Workstation 4.7.2
- AOMEI Backupper Workstation installations exposing the restore service
- Windows hosts running vulnerable AOMEI Backupper Workstation builds
Discovery Timeline
- 2025-08-20 - CVE-2025-8612 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-8612
Vulnerability Analysis
The vulnerability is a link-following flaw ([CWE-59]) in the restore workflow of AOMEI Backupper Workstation. The service performs file operations without validating whether target paths traverse a filesystem junction or symbolic link. A local attacker who can execute low-privileged code stages a directory containing a junction that redirects writes to a protected location. When an administrator invokes the restore functionality, the privileged service follows the junction and writes attacker-controlled content outside its intended path.
Exploitation requires two preconditions: local code execution as a standard user, and administrator interaction to trigger the restore action. The result is arbitrary file creation as SYSTEM, which attackers convert into code execution by planting DLLs, scheduled task definitions, or service binaries in protected directories.
Root Cause
The root cause is missing reparse point validation in the restore routine. The service opens or creates destination files without verifying that intermediate path components are legitimate directories owned by trusted principals. Windows resolves junctions during path traversal, so a redirected write inherits the privileges of the calling service rather than the low-privileged attacker.
Attack Vector
The attack vector is local. An attacker with an unprivileged shell prepares a working directory used by the restore process and replaces a subdirectory with an NTFS junction pointing to a sensitive location such as C:\Windows\System32. When the administrator launches a restore job, the service writes attacker-supplied files into the target path. Refer to the Zero Day Initiative Advisory ZDI-25-806 for additional detail on the exploitation primitive.
No verified proof-of-concept code is publicly available. See the ZDI advisory for technical details.
Detection Methods for CVE-2025-8612
Indicators of Compromise
- Creation of NTFS junctions or reparse points inside AOMEI Backupper working or staging directories by non-administrative users.
- Unexpected files written to C:\Windows\System32, C:\Program Files, or service directories with timestamps aligned to a restore operation.
- New services, scheduled tasks, or DLLs appearing after ABService.exe or related AOMEI processes execute a restore job.
Detection Strategies
- Monitor process telemetry for AOMEI service processes writing files outside their expected output paths.
- Alert on reparse point creation (FSCTL_SET_REPARSE_POINT) by standard user accounts in directories used by privileged installers or backup tools.
- Correlate low-privileged process activity with subsequent SYSTEM-level file writes to protected locations.
Monitoring Recommendations
- Enable Windows Sysmon events 11 (FileCreate) and 15 (FileCreateStreamHash) for AOMEI Backupper installation and working directories.
- Track child processes spawned by AOMEI services and flag any execution from user-writable paths.
- Review Windows Event Log entries for service-triggered file operations that resolve through junctions.
How to Mitigate CVE-2025-8612
Immediate Actions Required
- Upgrade AOMEI Backupper Workstation to a fixed release once the vendor publishes a patched build.
- Restrict administrator use of the restore functionality on shared or multi-user endpoints until patched.
- Remove or lock down user write access to any directories consumed by the AOMEI Backupper service.
Patch Information
No vendor advisory URL is listed in the NVD entry at time of publication. Consult the Zero Day Initiative Advisory ZDI-25-806 and the AOMEI vendor site for the current fixed version and upgrade guidance.
Workarounds
- Enforce least privilege so untrusted users cannot execute code on hosts running AOMEI Backupper Workstation.
- Require administrators to run restore operations only against paths on volumes not writable by standard users.
- Apply application allowlisting to prevent unauthorized DLLs or executables from loading out of directories touched by the restore service.
# Configuration example
# Audit reparse point creation on Windows using PowerShell
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; Id=11} |
Where-Object { $_.Message -match 'ReparsePoint|Junction' } |
Select-Object TimeCreated, Id, Message
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
