CVE-2024-25228

Deeper analysis

Vinchin Backup and Recovery versions 7.2 and earlier contain an authenticated remote code execution vulnerability in the getVerifydiyResult function within ManoeuvreHandler.class.php. The flaw is tracked as CVE-2024-25228 with a CVSS 3.1 score of 8.8 and is associated with CWE-77 command injection. The affected component allows remote attackers to supply crafted input that is executed on the server when the function processes verification results.

An attacker who has obtained low-privileged authenticated access can exploit the issue over the network without user interaction. Successful exploitation grants the ability to execute arbitrary commands, resulting in full compromise of confidentiality, integrity, and availability on the backup server. The published EPSS score of 0.5770 indicates a substantial likelihood of exploitation attempts.

Public disclosures on the Full Disclosure mailing list and a detailed technical analysis published by Leakix describe the vulnerability and a related exploitation chain, although no official vendor patch or mitigation guidance is referenced in the available sources.