CVE-2022-35866

CVE-2022-35866 is a critical authentication bypass vulnerability affecting Vinchin Backup and Recovery version 6.5.0.17561, stemming from a hard-coded administrator password in the MySQL server configuration. With a CVSS score of 9.8, this flaw allows unauthenticated remote attackers to gain full control over the system, leading to complete compromise of confidentiality, integrity, and availability. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion, indicating awareness and potential for future exploitation. Organizations using the affected product should prioritize patching to mitigate this severe risk.