CVE-2022-35866

Executive Summary

CVE-2022-35866 is a critical authentication bypass vulnerability affecting Vinchin Backup and Recovery version 6.5.0.17561. The flaw resides in the MySQL server configuration, which ships with a hard-coded password for the administrator user, allowing remote unauthenticated attackers to gain full administrative access to the database server. With a CVSS score of 9.8 and no authentication required for exploitation, this vulnerability exposes affected backup infrastructure to complete compromise, placing sensitive backup data and the entire backup environment at risk.

The vulnerability was disclosed through the ZDI program (ZDI-CAN-17139) and, as of current intelligence, remains unpatched with no vendor-fixed version or workaround available. The affected product, Vinchin Backup and Recovery, is a data backup and disaster recovery platform deployed primarily in enterprise environments; compromise of this system would grant attackers access to the central backup management plane, through which all protected workloads and their data can be manipulated or exfiltrated.

Technical Analysis

The vulnerability class is CWE-798: Use of Hard-Coded Credentials. The NVD description indicates that the specific flaw exists "within the configuration of the MySQL server" on Vinchin Backup and Recovery installations. The server uses a hard-coded password for the administrator user, meaning the database administrator credentials are embedded in the software configuration rather than being randomly generated during installation or set by the system administrator.

The attack surface is the MySQL server port exposed by the Vinchin Backup and Recovery installation. Backup solutions frequently bind their internal database to network interfaces to support the backup management console, distributed backup proxies, or replication functionality. If the MySQL server is bound to a non-loopback interface, the hard-coded credentials become remotely accessible.

The mechanism is straightforward: an attacker connects to the MySQL service over the network, attempts authentication using the known administrator username (for example, "root" or an equivalent administrative account) with the hard-coded password derived from the product's configuration, and upon successful authentication obtains database administrator privileges. Because the password is hard-coded identically across all installations of version 6.5.0.17561, a single credential disclosure (through reverse engineering, firmware extraction, or public research) renders every installation vulnerable.

Authentication is explicitly stated as not required to exploit this vulnerability, confirming that the MySQL service is accessible over the network without any preceding authentication step. The NVD description does not provide further implementation details — the exact administrator username and the specific hard-coded password value are not disclosed in the source data. Sufficient technical detail is available to understand the vulnerability class (hard-coded database credentials) but not to identify the precise credential pair whose disclosure would be required for exploitation.

The CVSS vector components — Network attack vector, Low attack complexity, No privileges required, No user interaction, with High confidentiality, integrity, and availability impact — align with a remotely reachable database containing sensitive backup metadata. Backup databases typically store job configurations, storage repository mappings, schedule definitions, and credential references for protected systems, making the impact assessment accurate.

Exploitation Scenarios

No public PoC or exploit code is available for this vulnerability. The following attack chain is inferred from the vulnerability class (hard-coded credentials in a network-exposed MySQL server) and the NVD description.

Step 1 — Reconnaissance and Target Identification: An attacker scans the internet or target network for hosts running Vinchin Backup and Recovery. The default MySQL service port (TCP 3306) or alternative ports configured for the embedded database would be identified through port scanning. Banner grabbing on the MySQL service may reveal the version, and HTTP/HTTPS scanning of Vinchin management console ports can confirm the product's presence. Shodan-style queries targeting Vinchin product banners or default service fingerprints can identify exposed instances.

Step 2 — Triggering the Flaw: The attacker connects to the identified MySQL service endpoint. Since the vulnerability requires no prior authentication, the attacker proceeds directly to the MySQL authentication handshake. The hard-coded administrator credential pair (username/password) is submitted as the authentication attempt. The MySQL server validates the credentials against its permission tables, where the hard-coded password is stored as the active credential for the administrator account.

Step 3 — Execution Method: Because the credential is hard-coded and identical across installations of the same version, the attacker submits the known credential pair to the MySQL protocol. Successful authentication grants the attacker full database administrator privileges. This is a credential-based bypass — no injection payload is required, merely the valid credential pair. The "payload" here is the credential itself, obtained by prior analysis of the Vinchin software distribution (e.g., extracting configuration files or binaries from an installer ISO).

Step 4 — Post-Exploitation Impact: With administrative access to the MySQL database, the attacker can:

• Extract backup job configurations and storage repository credentials, compromising the confidentiality of all protected systems' backup data.
• Modify or delete backup job definitions, impeding or destroying the organization's disaster recovery capability.
• Access sensitive data stored within backup metadata, including usernames, hostnames, paths, and possibly encrypted credentials for target systems.
• Leverage the MySQL account to write to the file system (if MySQL FILE privileges are enabled) potentially gaining operating system-level access through the MySQL server's host account.
• Pivot from the database to the broader Vinchin management plane, potentially injecting rogue backup agents or manipulating the backup console.

Impact Assessment

The CVSS score of 9.8 reflects the severity of this vulnerability: it is remotely exploitable without authentication, requires no user interaction, and has a low attack complexity. The complete compromise of the MySQL database — combined with the centrality of backup infrastructure — yields high impact across the confidentiality, integrity, and availability dimensions (C:H/I:H/A:H).

Business Impact: Organizations using Vinchin Backup and Recovery 6.5.0.17561 face a critical risk to their backup and recovery operations. The backup database is the control plane for all data protection activities. Compromise of this database:

• Exposes backup data itself (all protected workloads' data may be accessed or destroyed through the backup storage repositories the database references).
• Enables ransomware-style attacks where the attacker first disables or corrupts backups before launching a separate encryption attack — a known tactic in modern ransomware operations, ensuring the victim cannot recover.
• Violates regulatory compliance requirements related to data protection and access controls.

Affected Systems: All installations of Vinchin Backup and Recovery version 6.5.0.17561 are affected. No affected version range beyond this specific build is provided, and no patched version exists. The lack of patch availability elevates the risk — there is no remediation path other than workarounds and network segmentation.

Blast Radius: The blast radius extends beyond the backup database itself. Backup infrastructure typically holds privileged network positions (access to storage arrays, SANs, cloud storage, hypervisors, and protected servers). An attacker who compromises the backup database can leverage the stored storage repository credentials to access the actual backup data, and may be able to push modified backup configurations or agents to protected systems, expanding the compromise across the entire IT estate.

The EPSS score of 0.04084 (89.7th percentile of exploited CVEs) indicates elevated exploitation probability — this vulnerability is more likely to be exploited than 89.7% of known CVEs, suggesting that threat actors may already be targeting or plan to target it. The low absolute EPSS value (4%) reflects the narrow affected product footprint rather than low interest from attackers.

Detection Guidance

Detection of this vulnerability's exploitation centers on identifying anomalous access to the Vinchin MySQL service, failed or successful authentication events from unexpected sources, and database activity patterns inconsistent with normal backup operations.

Sigma Rule

title: Vinchin Backup MySQL Hard-Coded Credential Login Attempt
id: 951d62d1-9e2f-4f2a-8c71-3e58d4181775
status: experimental
description: Detects connection attempts to the MySQL service on Vinchin Backup and Recovery hosts using the hard-coded administrator credentials. Monitors for authentication events from remote sources.
author: Valtersit Threat Intelligence
date: 2024/08/25
logsource:
  product: mysql
  service: general
detection:
  selection_source:
    user: root@%
  selection_remote_src:
    src_ip:
      - "!127.0.0.1"
      - "!::1"
      - "!localhost"
  condition: selection_source and selection_remote_src
falsepositives:
  - Legitimate remote administration of the MySQL server (unlikely given embedded database usage)
level: high

YARA Rule

rule vinchin_hardcoded_mysql_credential
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects Vinchin Backup and Recovery binary/configuration artifacts containing hard-coded MySQL administrator credentials"
        cve = "CVE-2022-35866"
        date = "2024-08-25"
        severity = "critical"
    strings:
        $mysql_cfg = "mysql" ascii nocase
        $pwd_attr = "password" ascii nocase
        $root_user = "root" ascii nocase
        $vinchin_path = "Vinchin" ascii nocase
        $bin_cfg = "config" ascii nocase
        $sql_str = "GRANT ALL" ascii nocase
        $user_table = "mysql.user" ascii nocase
    condition:
        $mysql_cfg and $pwd_attr and $root_user and
        1 of ($vinchin_path, $bin_cfg, $sql_str) and 3 of them
}

Suricata IDS Rule

alert tcp any any -> $MYSQL_SERVERS 3306 (msg:"CVE-2022-35866 Vinchin Backup MySQL Hard-Coded Admin Login Attempt"; flow:to_server,established; content:"|00 00 00|"; depth:3; content:"|0a|"; distance:10; within:1; content:"mysql_native_password"; nocase; distance:0; within:256; threshold:type both, track by_src, count 3, seconds 60; metadata:created_at 2024_08_25, updated_at 2024_08_25, cve CVE-2022-35866; sid:1000668; rev:1;)

Note: The signature above detects multiple MySQL authentication attempts from a single source against a MySQL server (the hard-coded credential brute-force / repeated login pattern). Signature is illustrative of the authentication flow patterns; operators should tune thresholds based on baseline traffic.

Elastic Detection

authentication where network.protocol == "mysql" and
  /* Identify successful authentication from remote source addresses */
  event.outcome == "success" and
  not network.direction == "inbound" and
  source.ip != "127.0.0.1" and source.ip != "::1"
  /* Correlate with the affected product */
  and host.name is not null

Splunk SPL Query

index=mysql sourcetype=mysql:general:log
| search user="root" OR user="admin" OR user!=""
| where src_ip NOT IN ("127.0.0.1", "::1", "localhost")
| stats count by src_ip, user, dest_ip, dest_port
| where count > 5
| eval threat_score = if(count > 20, "HIGH", "MEDIUM")
| table _time, src_ip, user, dest_ip, dest_port, count, threat_score
| sort - count

Wazuh OSSEC Rule

<group name="mysql,">
  <rule id="100668" level="8">
    <decoded_as>mysql</decoded_as>
    <description>Vinchin Backup MySQL: repeated remote administrative login attempts — possible CVE-2022-35866 exploitation</description>
    <group>authentication_failed,</group>
    <if_sid>mysql_user_auth,</if_sid>
    <field name="srcip">!127.0.0.1</field>
    <field name="user">root|admin</field>
    <frequency>5</frequency>
    <timeframe>60</timeframe>
    <same_source_ip />
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source. No vendor fix, no patched version, and no official workaround documentation has been identified.

1. Immediate Mitigations (no patch available)

• Network Segmentation: Restrict inbound access to the Vinchin MySQL service (default TCP 3306, or as configured) to only trusted administrative hosts and backup proxy nodes. Implement strict firewall rules denying access from the general network and the internet.
• Disable Remote MySQL Access: Configure the MySQL server on the Vinchin host to bind only to 127.0.0.1 (loopback interface), preventing any remote connection attempts while preserving local backup service functionality.
• Change the Administrator Password: As an interim control, connect to the MySQL database through local socket or loopback and change the administrator password to a strong, randomly generated value. This neutralises the hard-coded credential, though note that reinstallation, software upgrades, or service restarts may reset credentials to the hard-coded default — validate after any maintenance activity.
• Network Monitoring: Deploy the detection rules above to alert on any remote MySQL connection attempts or authentication anomalies.

2. Patch/Upgrade Steps

• Monitor vendor communications (Vinchin official advisories, support portal) and ZDI advisory ZDI-CAN-17139 for a patched release. Until a fixed version is available, the mitigations above are the only protection options.
• When a patch becomes available, apply it to all production instances, staging environments, and any isolated backup infrastructure immediately, and verify the fix by testing that remote MySQL authentication no longer uses the hard-coded credentials.

3. Long-Term Hardening

• Treat the backup infrastructure as a critical trust boundary with the same protective posture as domain controllers or certificate authorities. Backup systems should reside in a dedicated management network segment with strict access control lists.
• Implement credential vaulting for all database and application accounts across the backup environment, eliminating reliance on static or embedded credentials.
• Conduct periodic credential audits to detect embedded or hard-coded credentials in all enterprise software, using static code analysis tools and configuration scanning.
• Establish vendor accountability for secure development practices, including mandatory removal of hard-coded credentials prior to product release and public vulnerability disclosure policies.

References

1. NVD Entry — CVE-2022-35866: https://nvd.nist.gov/vuln/detail/CVE-2022-35866 (Contains the official NVD description and CVSS score used in this report.)
2. ZDI Advisory — ZDI-CAN-17139: https://www.zerodayinitiative.com/advisories/ (The corresponding Zero Day Initiative vulnerability record that catalogued this issue under the Vinchin product.)
3. ZDI Public Disclosure Portal — https://www.zerodayinitiative.com/ (Primary source for pre-disclosure research and coordinated disclosure tracking related to CVE-2022-35866.)
4. CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2022-35866 is NOT currently listed in the CISA KEV, indicating no confirmed exploitation in the wild has been catalogued by CISA at the time of writing.)

Threat Actor Campaigns / Exploit-in-the-Wild Evidence: No public information indicates active exploitation campaigns targeting this CVE as of the reporting date. The vulnerability has not been added to the CISA KEV catalogue, and no exploit code or proof-of-concept has been publicly released. However, the high EPSS percentile (89.7%) indicates elevated future exploitation likelihood, and the unpatched status of this CVE makes it an attractive target for threat actors focusing on backup infrastructure compromise.