CyberRota Analysis
AI-GeneratedThe vulnerability exists in the ModuleHandShake function of the agentlink_server service in Vinchin Backup & Recovery, allowing unauthenticated remote attackers to exploit a stack buffer overflow. By sending a specially crafted request with an oversized _listen_uuid field, attackers can overwrite the return address, leading to potential process crashes or control flow hijacking. Organizations using affected versions of Vinchin Backup & Recovery should prioritize patching this vulnerability to mitigate risks of unauthorized access and system compromise.
Original NVD Description
Vinchin Backup & Recovery through 9.0.0.86562 contains a stack buffer overflow vulnerability in the ModuleHandShake function of the agentlink_server service that allows unauthenticated remote attackers to overwrite the saved return address by supplying an oversized _listen_uuid field that is measured via strlen() and copied without bounds checking into a fixed-length stack buffer using strcpy(). Attackers can send a crafted request with a malicious _listen_uuid value to corrupt the stack and achieve process crash or potential control flow hijack without requiring authentication.