Enter Software Iperius Backup stores a cryptographic key in the IperiusAccounts.ini file in a hard‑coded form. Manipulation of an unknown function of this file causes the application to use the fixed key, enabling an attacker to decrypt stored account credentials. This flaw is a classic example of insecure handling of cryptographic material, documented as CWE‑320 and CWE‑321.

All releases of Enter Software Iperius Backup up to and including version 8.7.2 are affected. The vendor has released a fixed version, 8.7.4, which removes the hard‑coded key and secures credential storage. Systems running an earlier version should be upgraded to 8.7.4 or later.

The CVSS score of 2 reflects a low baseline severity, yet the vulnerability is publicly documented and exploit code is available, indicating a realistic threat for attackers who have local access. The attack requires local privileges to modify the IperiusAccounts.ini file and has a high complexity, making exploitation difficult but not impossible. The vulnerability is not recorded in the CISA KEV catalog, but the public availability of an exploit raises the likelihood of targeted or opportunistic attacks on unpatched installations.