CVE-2024-25228 Command injection in n/a

What is CVE-2024-25228?

CVE-2024-25228 is a high-severity command injection vulnerability in n/a, published on 14 Mar 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Vinchin Backup and Recovery 7.2 and Earlier is vulnerable to Authenticated Remote Code Execution (RCE) via the getVerifydiyResult function in ManoeuvreHandler.class.php.

Weakness: CWE-77

Which versions are affected by CVE-2024-25228?

It affects 1 product.

Products include Vinchin Vinchin Backup and Recovery.

How do I fix CVE-2024-25228?

No fix has been published for CVE-2024-25228 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2024-25228 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-25228 exists.

Other vulnerabilities in n/a

• CVE-2024-22901 Hardcoded credentials in n/a Critical 9.8
• CVE-2024-22902 Hardcoded credentials in n/a Critical 9.8
• CVE-2023-45498 Command injection in n/a Critical 9.8
• CVE-2023-45499 Hardcoded credentials in n/a Critical 9.8
• CVE-2022-35866 Hardcoded credentials in Backup and Recovery Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-2hx4-gpwf-5qv2.