// For flags

CVE-2022-35866

Vinchin Backup and Recovery MySQL Server Use of Hard-coded Credentials Authentication Bypass Vulnerability

Severity Score

9.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Attend
*SSVC
Descriptions

This vulnerability allows remote attackers to bypass authentication on affected installations of Vinchin Backup and Recovery 6.5.0.17561. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of the MySQL server. The server uses a hard-coded password for the administrator user. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-17139.

Esta vulnerabilidad permite a atacantes remotos omitir la autenticación en las instalaciones afectadas de Vinchin Backup and Recovery versión 6.5.0.17561. No es requerida una autenticación para explotar esta vulnerabilidad. El fallo específico se presenta en la configuración del servidor MySQL. El servidor usa una contraseña codificada para el usuario administrador. Un atacante puede aprovechar esta vulnerabilidad para omitir la autenticación en el sistema. Era ZDI-CAN-17139

This vulnerability allows remote attackers to bypass authentication on affected installations of Vinchin Backup and Recovery. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the configuration of the MySQL server. The server uses a hard-coded password for the administrator user. An attacker can leverage this vulnerability to bypass authentication on the system.

A critical security issue has been discovered in Vinchin Backup and Recovery version 7.2. The software has been found to use default MYSQL credentials, which could lead to significant security risks.

*Credits: Esjay
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:Attend
Exploitation
None
Automatable
Yes
Tech. Impact
Total
* Organization's Worst-case Scenario
Timeline
  • 2022-07-08 CVE Published
  • 2022-07-14 CVE Reserved
  • 2024-01-26 First Exploit
  • 2024-11-20 CVE Updated
  • 2025-01-02 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-798: Use of Hard-coded Credentials
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Vinchin
Search vendor "Vinchin"
 Vinchin Backup And Recovery
Search vendor "Vinchin" for product "Vinchin Backup And Recovery"
 6.5.0.17561
Search vendor "Vinchin" for product "Vinchin Backup And Recovery" and version "6.5.0.17561"
-
Affected