CVE-2024-22902

CRITICAL

Published Feb 2, 2024 Modified Nov 4, 2025

Description

Vinchin Backup & Recovery v7.2 was discovered to be configured with default root credentials.

Is your site exposed to CVE-2024-22902?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions
vinchin	vinchin_backup_and_recovery	< 7.2

References

Exploits

https://blog.leakix.net/2024/01/vinchin-backup-rce-chain/ https://blog.leakix.net/2024/01/vinchin-backup-rce-chain/

Other References

http://default.com http://vinchin.com https://seclists.org/fulldisclosure/2024/Jan/31 http://default.com http://packetstormsecurity.com/files/176795/Vinchin-Backup-And-Recovery-7.2-Default-Root-Credentials.html http://seclists.org/fulldisclosure/2024/Jan/31 http://vinchin.com https://seclists.org/fulldisclosure/2024/Jan/31

Frequently Asked Questions

What is CVE-2024-22902? +

Vinchin Backup & Recovery v7.2 was discovered to be configured with default root credentials. It has a CVSS v3.1 base score of 9.8 (CRITICAL).

How severe is CVE-2024-22902? +

CVE-2024-22902 has a CVSS v3.1 score of 9.8 out of 10, rated CRITICAL. This is a critical vulnerability that should be patched immediately.

What products are affected by CVE-2024-22902? +

CVE-2024-22902 affects products from vinchin, specifically: vinchin_backup_and_recovery. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-22902? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-22901 9.8

Vinchin Backup & Recovery v7.2 was discovered to use default MYSQL credentials.

CVE-2024-22899 8.8

Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the syncNtpTime function.

CVE-2024-22900 8.8

Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the setNetworkCardInfo function.

CVE-2024-22903 8.8

Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the deleteUpdateAPK function.

CVE-2024-25228 8.8

Vinchin Backup and Recovery 7.2 and Earlier is vulnerable to Authenticated Remote Code Execution (RCE) via the getVerifydiyResult function in …