QNAP NetBak Replicator Vulnerability Allow Malicious Code Execution

According to GMO Cybersecurity by IERAE, Inc., security researchers Kazuma Matsumoto discovered and reported a critical vulnerability in QNAP NetBak Replicator that could enable local attackers to execute malicious code. The flaw, tracked as CVE-2025-57714, stems from an unquoted search path element in NetBak Replicator version 4.5.x, allowing authenticated local users to trigger unauthorized code execution.

The risk is described as an unquoted path weakness that could let a attacker place malicious executables where the system might execute them with elevated privileges. QNAP has addressed the issue in NetBak Replicator version 4.5.15.0807 and later releases, with a recommendation for organisations using affected versions to update promptly.

The article notes that exploitation requires local access to a user account, making the vulnerability particularly concerning in shared environments or where multiple administrators have access. It also urges defence-in-depth measures, including proper access controls and ongoing security assessments to mitigate similar risks.