CVE-2026-60095
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
A stack buffer overflow vulnerability in the agentlink_server service of Vinchin Backup & Recovery through version 9.0.0.86562. An unauthenticated remote attacker can overwrite the saved return address by sending a crafted request with an oversized _listen_uuid field, which is copied without bounds checking into a fixed-length stack buffer using strcpy().
Risk Assessment
An attacker can cause a process crash or hijack control flow, potentially disrupting backup and recovery operations or enabling remote code execution within the organization's infrastructure.
Recommendation
Immediately update Vinchin Backup & Recovery to the latest version containing a fix for this vulnerability. If an update is unavailable, restrict access to the agentlink_server service to trusted networks only.
Other vulnerabilities in Vinchin Backup & Recovery
See all- CVE-2024-22902Critical
Vinchin Backup & Recovery v7.2 was discovered to be configured with default root credentials. This means the system comes with easily guessable login credentials out of the box.
- CVE-2024-22901Critical
Vinchin Backup & Recovery v7.2 was found to use default MySQL credentials. This allows an attacker to gain unauthorized access to the database without password cracking.
- CVE-2026-60094Medium
Vinchin Backup & Recovery through version 9.0.0.86562 contains a heap buffer overflow vulnerability that allows unauthenticated remote attackers to cause a process crash or memory corruption by sending a malformed TCP packet with an unchecked body_len field to the agentlink_server service. Attackers can craft a malicious packet that passes an attacker-controlled length directly to recv(), triggering a heap overflow of up to approximately 4 GiB, resulting in process crash or potential memory corruption.
- CVE-2024-22903High
Vinchin Backup & Recovery v7.2 has an authenticated remote code execution (RCE) vulnerability in the deleteUpdateAPK function. An attacker with valid credentials can exploit this flaw to execute arbitrary code on the server.
- CVE-2024-22900High
Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the setNetworkCardInfo function. An attacker with a valid account can send a crafted request to this function, leading to arbitrary code execution on the server.
- CVE-2024-22899High
Vinchin Backup & Recovery v7.2 has an authenticated remote code execution (RCE) vulnerability in the syncNtpTime function. An attacker with valid credentials can exploit this flaw to execute arbitrary code on the server.
Original NVD description (English source)
Vinchin Backup & Recovery through 9.0.0.86562 contains a stack buffer overflow vulnerability in the ModuleHandShake function of the agentlink_server service that allows unauthenticated remote attackers to overwrite the saved return address by supplying an oversized _listen_uuid field that is measured via strlen() and copied without bounds checking into a fixed-length stack buffer using strcpy(). Attackers can send a crafted request with a malicious _listen_uuid value to corrupt the stack and achieve process crash or potential control flow hijack without requiring authentication.