PT-2024-1634 · Vinchin · Vinchin Backup & Recovery

Valentin Lobstein · Published 2024-01-25 · Updated 2025-05-15 · CVE-2024-22901

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Vinchin Backup & Recovery version 7.2

Description The issue is related to the use of default credentials in Vinchin Backup & Recovery. This could allow a remote attacker to elevate their privileges.

Recommendations For Vinchin Backup & Recovery version 7.2, change the default MYSQL credentials to custom, secure credentials as soon as possible to prevent exploitation. Consider restricting access to the MYSQL database until the credentials are changed.

Exploit

Fix

Weakness Enumeration

CWE-1392

Related Identifiers

BDU:2024-01304

CVE-2024-22901

Affected Products

Vinchin Backup & Recovery

References · 13

• 🔥 https://blog.leakix.net/2024/01/vinchin-backup-rce-chain · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-22901 · Security Note
• https://osv.dev/vulnerability/CVE-2024-22901 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-01304 · Security Note
• http://packetstormsecurity.com/files/176794/Vinchin-Backup-And-Recovery-7.2-Default-MySQL-Credentials.html · Note
• https://t.me/cvenotify/122431 · Telegram Post
• https://seclists.org/fulldisclosure/2024/Jan/30 · Note
• http://seclists.org/fulldisclosure/2024/Jan/30 · Note
• https://t.me/true_secator/5374 · Telegram Post
• http://vinchin.com · Note
• https://t.me/cvenotify/69726 · Telegram Post
• https://t.me/cvenotify/70445 · Telegram Post
• https://twitter.com/CVEnew/status/1753242612159647967 · Twitter Post