CVE-2023-45499

CVE-2023-45499

EPSS 7.9%

Vexday Risk Score

18Low

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 7.9%KEV nãoPoC —Nuclei —Metasploit simPatch —

Lifecycle

26 Oct 2023Metasploit module available

27 Oct 2023Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

VinChin Backup & Recovery v5.0.*, v6.0.*, v6.7.*, and v7.0.* was discovered to contain hardcoded credentials.

Affected products

References

http://packetstormsecurity.com/files/175397/VinChin-VMWare-Backup-7.0-Hardcoded-Credential-Remote-Code-Execution.html http://packetstormsecurity.com/files/176289/Vinchin-Backup-And-Recovery-Command-Injection.html https://blog.leakix.net/2023/10/vinchin-backup-rce-chain/http://seclists.org/fulldisclosure/2023/Oct/31