CVE-2024-22900

Vinchin Backup & Recovery v7.2 was discovered to be configured with default root credentials. This means the system comes with easily guessable login credentials out of the box.

Vinchin Backup & Recovery v7.2 was found to use default MySQL credentials. This allows an attacker to gain unauthorized access to the database without password cracking.

A stack buffer overflow vulnerability in the agentlink_server service of Vinchin Backup & Recovery through version 9.0.0.86562. An unauthenticated remote attacker can overwrite the saved return address by sending a crafted request with an oversized _listen_uuid field, which is copied without bounds checking into a fixed-length stack buffer using strcpy().

Vinchin Backup & Recovery through version 9.0.0.86562 contains a heap buffer overflow vulnerability that allows unauthenticated remote attackers to cause a process crash or memory corruption by sending a malformed TCP packet with an unchecked body_len field to the agentlink_server service. Attackers can craft a malicious packet that passes an attacker-controlled length directly to recv(), triggering a heap overflow of up to approximately 4 GiB, resulting in process crash or potential memory corruption.

Vinchin Backup & Recovery v7.2 has an authenticated remote code execution (RCE) vulnerability in the deleteUpdateAPK function. An attacker with valid credentials can exploit this flaw to execute arbitrary code on the server.

Vinchin Backup & Recovery v7.2 has an authenticated remote code execution (RCE) vulnerability in the syncNtpTime function. An attacker with valid credentials can exploit this flaw to execute arbitrary code on the server.