CVE-2022-35866
CRITICALVinchin Backup and Recovery 6.5.0.17561 - Auth Bypass
Title source: llmDescription
This vulnerability allows remote attackers to bypass authentication on affected installations of Vinchin Backup and Recovery 6.5.0.17561. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of the MySQL server. The server uses a hard-coded password for the administrator user. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-17139.
References (3)
Core 3
Core References
Mailing List mailing-list
http://seclists.org/fulldisclosure/2024/Jan/30
Third Party Advisory, VDB Entry
https://www.zerodayinitiative.com/advisories/ZDI-22-959/
Exploit, Third Party Advisory
http://packetstormsecurity.com/files/176794/Vinchin-Backup-And-Recovery-7.2-Default-MySQL-Credentials.html
Scores
CVSS v3
9.8
EPSS
0.0305
EPSS Percentile
85.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
total
Details
CWE
CWE-798
Status
published
Products (1)
vinchin/vinchin_backup_and_recovery
6.5.0.17561
Published
Aug 03, 2022
Tracked Since
Feb 18, 2026