CVE-2025-12247
Hasleo Backup Suite HasleoImageMountService/HasleoBackupSuiteService unquoted search path
- State
- Published
- Severity
- 7.3 High
- Published
- Oct 27, 2025
- Updated
- Oct 27, 2025
- Reserved
- Oct 26, 2025
Description
A weakness has been identified in Hasleo Backup Suite up to 5.2. Impacted is an unknown function of the component HasleoImageMountService/HasleoBackupSuiteService. This manipulation causes unquoted search path. The attack is restricted to local execution. The attack's complexity is rated as high. The exploitability is considered difficult. The exploit has been made available to the public and could be exploited. Upgrading the affected component is advised.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.3 High | CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 7.0 High | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C | VulDB |
| 3.0 | 7.0 High | CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C | VulDB |
| 2.0 | 6.0 Medium | AV:L/AC:H/Au:S/C:C/I:C/A:C/E:POC/RL:OF/RC:C | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
Backup SuiteHasleo |
|
References
- VDB-329918 | Hasleo Backup Suite HasleoImageMountService/HasleoBackupSuiteService unquoted search pathvdb-entry
- VDB-329918 | CTI Indicators (IOB, IOC, TTP)signaturepermissions-required
- Submit #672549 | Hasleo Software Hasleo Backup Suite 5.2 Unquoted Search Paththird-party-advisory
- Submit #672548 | Hasleo Software Hasleo Backup Suite 5.2 Unquoted Search Path (Duplicate)third-party-advisory
- https://github.com/lakshayyverma/CVE-Discovery/blob/main/Hasleo%20Backup%20Suite%20ImageMountService.mdrelated
- https://github.com/lakshayyverma/CVE-Discovery/blob/main/Halseo%20Backupservice.mdexploit
- https://www.easyuefi.com/backup-software/downloads/Hasleo_Backup_Suite_Free.exepatch
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.