CVE-2025-48501

CVE-2025-48501 is a critical OS command injection vulnerability affecting Nimesa Backup and Recovery versions 2.3 and 2.4. This flaw allows an unauthenticated attacker to execute arbitrary operating system commands remotely on the server running the product. With a CVSS score of 9.8, it presents a severe risk due to its network-based attack vector, low attack complexity, and complete compromise of confidentiality, integrity, and availability. While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion, indicating awareness and potential for future exploitation. Organizations using affected versions should restrict access to the product and monitor for vendor patches.