Default credentials

Vinchin Backup & Recovery v7.2 was discovered to use default MYSQL credentials...

Default credentials

Vinchin Backup & Recovery v7.2 was discovered to be configured with default root credentials...

Remote code execution

Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution RCE vulnerability via the syncNtpTime function...

Remote code execution

Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution RCE vulnerability via the deleteUpdateAPK function...

CVE-2024-22900

Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution RCE vulnerability via the setNetworkCardInfo function...

CVE-2024-22902

Vinchin Backup & Recovery v7.2 was discovered to be configured with default root credentials...

CVE-2024-22899

Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution RCE vulnerability via the syncNtpTime function...

CVE-2024-22903

Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution RCE vulnerability via the deleteUpdateAPK function...

Agent DVR Backup Restore Code Execution File Upload

The vulnerability of the Backup/Restore function of the video surveillance software for DVR systems is related to incorrect restrictions on the path to the restricted-access directory. Exploiting this vulnerability could allow an attacker to execute arbitrary commands and upload arbitrary files...

CVE-2024-22903: Improper Neutralization of Special Elements used in a Command

Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution RCE vulnerability via the deleteUpdateAPK function...

CVE-2024-22902: Undefined Security Weakness

Vinchin Backup & Recovery v7.2 was discovered to be configured with default root credentials...

CVE-2024-22900: Improper Neutralization of Special Elements used in a Command

Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution RCE vulnerability via the setNetworkCardInfo function...

CVE-2024-22899: Improper Control of Generation of Code

Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution RCE vulnerability via the syncNtpTime function...

CVE-2024-22901: Undefined Security Weakness

Vinchin Backup & Recovery v7.2 was discovered to use default MYSQL credentials...

Vinchin Backup and Recovery Security Vulnerabilities

Vinchin Backup and Recovery is an easy-to-use, safe and reliable virtual machine data protection software from China Yunqi Technology Vinchin. It is used for backup and recovery. A security vulnerability exists in Vinchin Backup and Recovery v7.2. An attacker can exploit the vulnerability to...

CVE-2024-22901

CVE-2024-22901 affects Vinchin Backup & Recovery v7.2 (and earlier) where default MySQL credentials are used. Public sources in connected documents confirm the underlying issue is default credentials enabling unauthenticated access, with CVSS 3.1 base score 9.8 (CRITICAL) and impact to confidenti...

CVE-2024-22900

Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution RCE vulnerability via the setNetworkCardInfo function...

Vinchin Backup and Recovery Security Vulnerabilities

Vinchin Backup and Recovery is an easy-to-use, safe and reliable virtual machine data protection software from China Yunqi Technology Vinchin. It is used for backup and recovery. A security vulnerability exists in Vinchin Backup and Recovery v7.2. An attacker can exploit the vulnerability to...

CVE-2024-22899

Vinchin Backup & Recovery v7.2 (and earlier) has an authenticated remote code execution (RCE) vulnerability in the syncNtpTime function. The issue stems from the ntphost handling in SystemHandler.class.php, where user-controlled input can be injected into a system command, enabling arbitrary comm...

CVE-2024-22902

Vinchin Backup & Recovery v7.2 was discovered to be configured with default root credentials...