CVE-2024-22901

CriticalCVSS 9.8

Published: 02/02/2024(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.10%

62th percentile - higher than 62% of all known CVEs

Summary

Vinchin Backup & Recovery v7.2 was found to use default MySQL credentials. This allows an attacker to gain unauthorized access to the database without password cracking.

Risk Assessment

The risk involves potential compromise of the backup database, leading to data leakage, modification, or deletion of backups, which could disrupt business continuity.

Recommendation

Immediately change the default MySQL password to a strong, unique one. Consider restricting database access to trusted IP addresses and implementing log monitoring for unauthorized login attempts.

Original NVD description (English source)

Vinchin Backup & Recovery v7.2 was discovered to use default MYSQL credentials.