Default MySQL Credentials Vulnerability in Vinchin Backup & Recovery
CVE-2024-22901

9.8CRITICAL

Key Information:

Vendor

Vinchin

Status
Vinchin Backup And Recovery
Vendor
CVE Published:
2 February 2024

What is CVE-2024-22901?

A vulnerability has been identified in Vinchin Backup & Recovery v7.2 due to the usage of default MySQL credentials, which can potentially allow unauthorized access to sensitive data and compromise the integrity of the backup system. This flaw emphasizes the importance of modifying default credentials in critical software to prevent security breaches. Organizations leveraging Vinchin’s solutions should prioritize immediate remediation steps to safeguard their data and infrastructure.

References

https://seclists.org/fulldisclosure/2024/Jan/30
https://blog.leakix.net/2024/01/vinchin-backup-rce-chain/

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.