CVE-2024-22901
Critical · CVSS 9.8Vinchin Backup & Recovery — Default Credentials (MySQL)
- CVSS
- 9.8
- nvd
- EPSS
- —
- KEV
- No
- Class
- other
- NVD-CWE-Other
Description
Vinchin Backup & Recovery v7.2 was discovered to use default MYSQL credentials.
Search profile — drives PoC discovery
Symbols MYSQLdefault credentialsvinchinbackuprecoverymysql_connectrootdatabase authentication
Keywords CVE-2024-22901Vinchin Backup Recoverydefault MySQL credentialsVinchin v7.2Vinchin RCE chainVinchin MySQL default passwordVinchin database credentials
Versions: v7.2
Ranked PoCs (3) — best first
Heuristic ranking — not yet expert-vetted. Scored on structure + provenance, not execution.
- ★ 0
- ★ 0
- ★ 0komodoooo/Some-things needs reviewtrickest
Recall-favoring discovery; ranking by the Stage-4 scorer (Adam's rubric). Scanner/aggregator repos are hidden.
References
- https://blog.leakix.net/2024/01/vinchin-backup-rce-chain/
- https://seclists.org/fulldisclosure/2024/Jan/30
- http://packetstormsecurity.com/files/176794/Vinchin-Backup-And-Recovery-7.2-Default-MySQL-Credentials.html
- http://seclists.org/fulldisclosure/2024/Jan/30
- http://vinchin.com
- https://blog.leakix.net/2024/01/vinchin-backup-rce-chain/
- https://seclists.org/fulldisclosure/2024/Jan/30
Status: enriched · ingested 2026-07-05T06:00:39.000Z · profiled 2026-07-06T00:30:39.000Z