Lucene search

[email protected]CVE-2024-22900

HistoryFeb 02, 2024 - 2:15 a.m.

CVE-2024-22900

2024-02-0202:15:18

CWE-77

[email protected]

web.nvd.nist.gov

cve-2024-22900

vinchin backup & recovery

rce

vulnerability

nvd

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.4 High

AI Score

Confidence

High

6.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

0.002 Low

EPSS

Percentile

52.6%

JSON

Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the setNetworkCardInfo function.

CPENameOperatorVersion
vinchin:vinchin_backup_and_recoveryvinchin vinchin backup and recoveryle7.2
vinchin:vinchin_backup_and_recoveryvinchin vinchin backup and recoveryeq6.7
vinchin:vinchin_backup_and_recoveryvinchin vinchin backup and recoveryeq6.0
vinchin:vinchin_backup_and_recoveryvinchin vinchin backup and recoveryeq5.0
vinchin:vinchin_backup_and_recoveryvinchin vinchin backup and recoveryeq6.5.0.17561
vinchin:vinchin_backup_and_recoveryvinchin vinchin backup and recoveryeq7.0

CPE	Name	Operator	Version
vinchin:vinchin_backup_and_recovery	vinchin vinchin backup and recovery	le	7.2
vinchin:vinchin_backup_and_recovery	vinchin vinchin backup and recovery	eq	6.7
vinchin:vinchin_backup_and_recovery	vinchin vinchin backup and recovery	eq	6.0
vinchin:vinchin_backup_and_recovery	vinchin vinchin backup and recovery	eq	5.0
vinchin:vinchin_backup_and_recovery	vinchin vinchin backup and recovery	eq	6.5.0.17561
vinchin:vinchin_backup_and_recovery	vinchin vinchin backup and recovery	eq	7.0

References

vinchin.com

blog.leakix.net/2024/01/vinchin-backup-rce-chain/

seclists.org/fulldisclosure/2024/Jan/29

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.4 High

AI Score

Confidence

High

6.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

0.002 Low

EPSS

Percentile

52.6%

JSON

Related for CVE-2024-22900

packetstorm1 zdt1 cvelist1 prion1