CVE-2024-39206

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-07-02 · updated 2026-06-17
Weakness: CWE-269

Description

An issue discovered in MSP360 Backup Agent v7.8.5.15 and v7.9.4.84 allows attackers to obtain network share credentials used in a backup due to enginesettings.list being encrypted with a hard coded key.

Affected products

MSP360 Backup Agent: 7.8.5.15, 7.9.4.84

References

https://www.proactivelabs.com.au/2024/06/19/cloudberry.html
https://www.proactivelabs.com.au/2024/06/19/cloudberry.html

Get alerted when CVE-2024-39206 or the next vulnerability affects your stack