CVE-2024-22903

Vinchin Backup & Recovery v7.2 was discovered to be configured with default root credentials. This means the system comes with easily guessable login credentials out of the box.

Vinchin Backup & Recovery v7.2 was found to use default MySQL credentials. This allows an attacker to gain unauthorized access to the database without password cracking.

A stack buffer overflow vulnerability in the agentlink_server service of Vinchin Backup & Recovery through version 9.0.0.86562. An unauthenticated remote attacker can overwrite the saved return address by sending a crafted request with an oversized _listen_uuid field, which is copied without bounds checking into a fixed-length stack buffer using strcpy().

Vinchin Backup & Recovery through version 9.0.0.86562 contains a heap buffer overflow vulnerability that allows unauthenticated remote attackers to cause a process crash or memory corruption by sending a malformed TCP packet with an unchecked body_len field to the agentlink_server service. Attackers can craft a malicious packet that passes an attacker-controlled length directly to recv(), triggering a heap overflow of up to approximately 4 GiB, resulting in process crash or potential memory corruption.

Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the setNetworkCardInfo function. An attacker with a valid account can send a crafted request to this function, leading to arbitrary code execution on the server.

Vinchin Backup & Recovery v7.2 has an authenticated remote code execution (RCE) vulnerability in the syncNtpTime function. An attacker with valid credentials can exploit this flaw to execute arbitrary code on the server.