CVE-2024-22902

Vinchin Backup & Recovery v7.2 was discovered to be configured with default root credentials. This means the system comes with easily guessable login credentials out of the box.

An attacker can gain full administrative access to the backup system, enabling theft, modification, or deletion of backup data and full control over the infrastructure.

Immediately change the default root password to a strong, unique password. Additionally, implement multi-factor authentication (MFA) for all administrative accounts.