CVE-2024-22899

Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the syncNtpTime function.

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

2.37% chance of exploitation in the next 30 days, 83th percentile

Published

2024-02-02

Updated

2026-07-09

Proof-of-concept exploits (2)

• https://blog.leakix.net/2024/01/vinchin-backup-rce-chain/
• Chocapikk/CVE-2024-22899-to-22903-ExploitChain8★ · 2025-04-06

References

• CVE Record
• NVD entry

Related

• CVE-2024-22894
• CVE-2024-22900
• CVE-2024-22891
• CVE-2024-22901
• CVE-2024-22889
• CVE-2024-22902