Command Injection Vulnerability in VinChin Backup & Recovery by VinChin
CVE-2023-45498

9.8CRITICAL

Key Information:

Vendor

Vinchin

Status
Vinchin Backup And Recovery
Vendor
CVE Published:
27 October 2023

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 20%

What is CVE-2023-45498?

A command injection vulnerability has been identified in VinChin Backup & Recovery, impacting versions 5.0 through 7.0. This vulnerability allows an attacker to inject malicious commands that can be executed with the privileges of the application, potentially leading to unauthorized access and control over the system. Users of VinChin Backup & Recovery are advised to implement the necessary security measures to mitigate the risks associated with this vulnerability.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

Metasploit exploit module for CVE-2023-45498
Created by Rapid7

References

https://blog.leakix.net/2023/10/vinchin-backup-rce-chain/
http://seclists.org/fulldisclosure/2023/Oct/31
mailing-list
http://packetstormsecurity.com/files/175397/VinChin-VMWar...

EPSS Score

20% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.