CVE-2023-45498 | BDVDB-2026-215340 Detail
Description#
VinChin Backup & Recovery v5.0.*, v6.0.*, v6.7.*, and v7.0.* was discovered to contain a command injection vulnerability.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact high, availability impact high. Attack vector: network.
Weaknesses#
- CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
References#
- https://blog.leakix.net/2023/10/vinchin-backup-rce-chain/
- http://seclists.org/fulldisclosure/2023/Oct/31
- http://packetstormsecurity.com/files/175397/VinChin-VMWare-Backup-7.0-Hardcoded-Credential-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/176289/Vinchin-Backup-And-Recovery-Command-Injection.html
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.