PT-2024-1516 · Vinchin · Vinchin Backup & Recovery

Valentin Lobstein · Published 2024-02-01 · Updated 2025-05-15 · CVE-2024-22902

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Vinchin Backup & Recovery version 7.2

Description The issue is related to the use of default root credentials in Vinchin Backup & Recovery. This could allow a remote attacker to gain elevated privileges to the level of a root user by connecting with the default credentials via the SSH protocol.

Recommendations For Vinchin Backup & Recovery version 7.2, change the default root credentials to secure ones as soon as possible to prevent potential exploitation. Consider restricting SSH access until the credentials are changed.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

BDU:2024-01027

CVE-2024-22902

Affected Products

Vinchin Backup & Recovery

References · 15

• 🔥 https://blog.leakix.net/2024/01/vinchin-backup-rce-chain · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-22902 · Security Note
• https://bdu.fstec.ru/vul/2024-01027 · Security Note
• https://osv.dev/vulnerability/CVE-2024-22902 · Vendor Advisory
• http://seclists.org/fulldisclosure/2024/Jan/31 · Note
• https://seclists.org/fulldisclosure/2024/Jan/31 · Note
• http://vinchin.com · Note
• http://default.com · Note
• https://t.me/cvenotify/70446 · Telegram Post
• https://twitter.com/CVEnew/status/1753242612998537717 · Twitter Post
• https://t.me/cvenotify/69727 · Telegram Post
• https://t.me/true_secator/5374 · Telegram Post
• http://packetstormsecurity.com/files/176795/Vinchin-Backup-And-Recovery-7.2-Default-Root-Credentials.html · Note
• https://twitter.com/VulmonFeeds/status/1753336460520952010 · Twitter Post
• https://t.me/cvenotify/122432 · Telegram Post