← Vulnerability feed

Vulnerability record · CVE-2024-22902 · published 2 February 2024

CVE-2024-22902: Vinchin backup and recovery vulnerability

Vinchin · Vinchin Backup And Recovery

Vinchin Backup & Recovery v7.2 was discovered to be configured with default root credentials.

9.8 CVSS 3.1 Critical EPSS 1.1% · top 36.4%
9.8CVSS 3.1 base score
1.1%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References, 2 tagged exploit
9 Jul 2026Last modified by NVD

Description

Vinchin Backup & Recovery v7.2 was discovered to be configured with default root credentials.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://blog.leakix.net/2024/01/vinchin-backup-rce-chain/ ExploitThird Party Advisory
https://seclists.org/fulldisclosure/2024/Jan/31 Mailing ListThird Party Advisory
http://packetstormsecurity.com/files/176795/Vinchin-Backup-And-Recovery-7.2-Default-Root-Credentials.html
http://seclists.org/fulldisclosure/2024/Jan/31
https://blog.leakix.net/2024/01/vinchin-backup-rce-chain/ ExploitThird Party Advisory
https://seclists.org/fulldisclosure/2024/Jan/31 Mailing ListThird Party Advisory

Track CVE-2024-22902 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2024-22901Vinchin backup and recovery vulnerabilityVinchin Backup & Recovery v7.2 was discovered to use default MYSQL credentials.EPSS 1.1%9.8CVE-2023-45498Vinchin backup and recovery command injection vulnerabilityVinChin Backup & Recovery v5.0.*, v6.0.*, v6.7.*, and v7.0.* was discovered to contain a command injection vulnerability.EPSS 20%9.8CVE-2023-45499Vinchin backup and recovery hard-coded credentials vulnerabilityVinChin Backup & Recovery v5.0.*, v6.0.*, v6.7.*, and v7.0.* was discovered to contain hardcoded credentials.EPSS 7.9%9.8CVE-2022-35866Vinchin backup and recovery hard-coded credentials vulnerabilityThis vulnerability allows remote attackers to bypass authentication on affected installations of Vinchin Backup and Recovery 6.5.0.17561. Authenticat…EPSS 4.2%8.8CVE-2024-25228Vinchin backup and recovery command injection vulnerabilityVinchin Backup and Recovery 7.2 and Earlier is vulnerable to Authenticated Remote Code Execution (RCE) via the getVerifydiyResult function in Manoeuv…EPSS 26%8.8CVE-2024-22899Vinchin backup and recovery code injection vulnerabilityVinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the syncNtpTime function.EPSS 2.4%8.8CVE-2024-22900Vinchin backup and recovery command injection vulnerabilityVinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the setNetworkCardInfo functi…EPSS 1.9%8.8CVE-2024-22903Vinchin backup and recovery command injection vulnerabilityVinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the deleteUpdateAPK function.EPSS 1.9%

Source: NIST National Vulnerability Database (record CVE-2024-22902), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.