Table of Contents

    About the Author

    Security Advisory

    Security Advisory

    The CyberMaxx team publishes weekly security advisories based on data and research found in the wild.

    More Articles

    Additional Resources:

    Ransomware Research Report | Q1 2025 – Audio Blog Interview

    Ransomware Research Report | Q1 2025 – Audio Blog Interview

    Interviews

    4 min read

    Security Advisory: Weekly Advisory April 23rd, 2025

    Security Advisory: Weekly Advisory April 23rd, 2025

    Company News

    3 min read

    In this week’s Security Advisory

    • Veeam Patches Critical Backup & Replication Vulnerability
    • CrushFTP Patches Authentication Bypass Vulnerability
    • Ingress NGINX Controller Vulnerable to Unauthenticated RCE
    • New Vulnerability in VMware Tools for Windows

    Veeam Patches Critical Backup & Replication Vulnerability

    Veeam has now patched a critical vulnerability affecting its Backup & Replication product. The vulnerability, CVE-2025-23120 (CVSS 9.9/10), could allow for remote code execution by authenticated domain users.

    Affected Versions

    Veeam Backup & Replication version 12.3.0.310 and all earlier version 12 builds.

    Recommendations

    • Upgrade to Veeam Backup & Replication build 12.3.1.1139.

    More Reading / Information

    CrushFTP Patches Authentication Bypass Vulnerability

    CrushFTP released an update to address a newly discovered critical vulnerability. This vulnerability can lead to an unauthenticated attacker accessing unpatched servers if they are accessible over HTTPS. CrushFTP indicates that the vulnerability is mitigated when the DMZ feature of the service is activated . Currently, there are no reports of this being exploited in the wild, however, it is still recommended to patch as soon as possible.

    Affected Versions

    • CrushFTP 11.0.0 to 11.3.0.
    • CrushFTP 10.0.0 to 10.8.3.

    Recommendations

    • Update CrushFTP 11.0.0 to 11.3.0 to 11.3.1 or later.
    • Update CrushFTP 10.0.0 to 10.8.3 to 10.8.4 or later.

    More Reading / Information

    Ingress NGINX Controller Vulnerable to Unauthenticated RCE

    Patches are now available to address five new vulnerabilities discovered in the Ingress NGINX Controller for Kubernetes. These vulnerabilities can be chained together to achieve unauthenticated remote code execution and directory traversal. The vulnerabilities are CVE-2025-24513, CVE-2025-24514, CVE-2025-1097, CVE-2025-1098, and CVE-2025-1974, with the highest being a CVSS 9.8/10

    Affected Versions

    • Ingress NGINX Controller versions prior to 1.11.5.
    • Ingress NGINX Controller version 1.12.0-beta.0 and later.

    Recommendations

    • Upgrade to Ingress NGINX Controller versions 1.12.1, 1.11.5, or 1.10.7.
    • If you can’t upgrade right away, you can significantly reduce your risk by turning off the Validating Admission Controller feature of ingress-nginx.

    More Reading / Information

    New Vulnerability in VMware Tools for Windows

    VMware released a patch for an authentication bypass vulnerability in VMware Tools for Windows. The vulnerability is being tracked as CVE-2025-22230 (CVSS 7.8/10). VMware Tools for Windows is a suite of utilities and drivers that enhances the performance and management of virtual machines. The Linux and macOS versions of the utilities are not affected.

    Affected Versions

    • All versions of VMware Tools for Windows before v12.5.1.

    Recommendations

    • Upgrade to VMware Tools for Windows v12.5.1.

    More Reading / Information

    Recommendations

    Please review your environment to ensure the above-mentioned issues are patched in a timely manner. It is security best practice to regularly update and/or patch software to the latest versions. The vulnerabilities above highlight the security benefits of limiting deployed software to “vendor-supported versions” only. This dramatically increases the likelihood that new vulnerabilities have a patch issued for them. Likewise, CyberMaxx strongly encourages maintaining an inventory of current software in your environment, which helps ensure and inform your patch and vulnerability management program.