← Vulnerability feed

Vulnerability record · CVE-2024-25228 · published 14 March 2024

CVE-2024-25228: Vinchin backup and recovery command injection vulnerability

Vinchin · Vinchin Backup And Recovery

Vinchin Backup and Recovery 7.2 and Earlier is vulnerable to Authenticated Remote Code Execution (RCE) via the getVerifydiyResult function in ManoeuvreHandler.class.php.

8.8 CVSS 3.1 High EPSS 26% · top 2.1% CWE-77 · Command injection
8.8CVSS 3.1 base score
26%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
5References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

Vinchin Backup and Recovery 7.2 and Earlier is vulnerable to Authenticated Remote Code Execution (RCE) via the getVerifydiyResult function in ManoeuvreHandler.class.php.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://blog.leakix.net/2024/01/vinchin-backup-rce-chain/ ExploitThird Party Advisory
https://seclists.org/fulldisclosure/2024/Mar/15 Mailing List
http://seclists.org/fulldisclosure/2024/Mar/15
https://blog.leakix.net/2024/01/vinchin-backup-rce-chain/ ExploitThird Party Advisory
https://seclists.org/fulldisclosure/2024/Mar/15 Mailing List

Track CVE-2024-25228 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2024-22901Vinchin backup and recovery vulnerabilityVinchin Backup & Recovery v7.2 was discovered to use default MYSQL credentials.EPSS 1.1%9.8CVE-2024-22902Vinchin backup and recovery vulnerabilityVinchin Backup & Recovery v7.2 was discovered to be configured with default root credentials.EPSS 1.1%9.8CVE-2023-45498Vinchin backup and recovery command injection vulnerabilityVinChin Backup & Recovery v5.0.*, v6.0.*, v6.7.*, and v7.0.* was discovered to contain a command injection vulnerability.EPSS 20%9.8CVE-2023-45499Vinchin backup and recovery hard-coded credentials vulnerabilityVinChin Backup & Recovery v5.0.*, v6.0.*, v6.7.*, and v7.0.* was discovered to contain hardcoded credentials.EPSS 7.9%9.8CVE-2022-35866Vinchin backup and recovery hard-coded credentials vulnerabilityThis vulnerability allows remote attackers to bypass authentication on affected installations of Vinchin Backup and Recovery 6.5.0.17561. Authenticat…EPSS 4.2%8.8CVE-2024-22899Vinchin backup and recovery code injection vulnerabilityVinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the syncNtpTime function.EPSS 2.4%8.8CVE-2024-22900Vinchin backup and recovery command injection vulnerabilityVinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the setNetworkCardInfo functi…EPSS 1.9%8.8CVE-2024-22903Vinchin backup and recovery command injection vulnerabilityVinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the deleteUpdateAPK function.EPSS 1.9%

Source: NIST National Vulnerability Database (record CVE-2024-25228), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.