CVE-2024-22900 is an authenticated remote code execution vulnerability found in Vinchin Backup & Recovery version 7.2. The flaw exists in the setNetworkCardInfo function, which improperly handles input, allowing an attacker with valid privileges to execute arbitrary commands remotely. This vulnerability is categorized under CWE-77, indicating command injection due to improper input neutralization. The CVSS 3.1 base score is 8.8, with attack vector network, low attack complexity, requiring privileges, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability allows an authenticated attacker to execute arbitrary code on the affected system remotely. This can lead to full compromise of the backup and recovery system, potentially exposing sensitive backup data, disrupting backup operations, and impacting system availability and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected function to trusted users only and monitor for suspicious activity. Avoid exposing the management interface to untrusted networks. Follow vendor updates closely for patch releases.