A local privilege escalation vulnerability in Iperius Backup 6.1.0 allows low-privileged users to execute arbitrary code with elevated system permissions.

The application is vulnerable to privilege escalation due to improper file permissions on the application installation directory and the ability to configure pre-or-post backup tasks. A low-privileged user can create a backup job that executes malicious scripts or binaries, which are then run by the Iperius Backup Service account with Local System or Administrator privileges.

Successful exploitation allows a local attacker to bypass security boundaries and gain full control over the host system. This level of access enables the compromise of sensitive data, the installation of persistent malware, and the potential lateral movement within the network. With a CVSS score of 8.4, this vulnerability represents a high-risk scenario for any organization utilizing the affected software on Windows workstations or servers.

Immediate Action: Upgrade to a patched version of Iperius Backup where the excessive permissions on the application data directory have been restricted.

Proactive Monitoring: Review system logs for the execution of unexpected batch files or executables triggered by the Iperius Backup service.

Compensating Controls: Apply strict NTFS permissions to the C:\ProgramData\IperiusBackup directory to remove "Everyone" access and ensure only authorized administrative accounts have modification rights.

Public Exploit Available: Yes, a proof-of-concept exploit is available via ExploitDB (EDB-ID: 46863).

Organizations must prioritize the remediation of this vulnerability on all systems where Iperius Backup is deployed. Given the availability of a public exploit and the ease of privilege escalation, immediate configuration changes to restrict directory permissions are essential if an update cannot be applied instantly. Failure to address this flaw leaves the underlying host susceptible to full system compromise by any local user account.