Default Credentials Vulnerability in Vinchin Backup & Recovery Software
CVE-2024-22902

9.8CRITICAL

Key Information:

Vendor

Vinchin

Status
Vinchin Backup And Recovery
Vendor
CVE Published:
2 February 2024

What is CVE-2024-22902?

The Vinchin Backup & Recovery software version 7.2 has been identified as having a vulnerability due to the use of default root credentials. This configuration can allow unauthorized users to gain access to the system, potentially leading to data exposure or compromise. Organizations utilizing this software must take immediate steps to rectify this configuration by changing the default credentials to mitigate associated security risks.

References

https://seclists.org/fulldisclosure/2024/Jan/31
https://blog.leakix.net/2024/01/vinchin-backup-rce-chain/

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.