by Kastro
Paper/Archive/CVE-2023-45249

CVE-2023-45249

Acronis Acronis Cyber Infrastructure — Acronis Cyber Infrastructure (ACI) Insecure Default Password Vulnerability

KEV · due 19 AugEPSS 53%public exploitSSVC actCVSS 9.8
critical.is priorityof 100
99
CVSS 9.8 (CNA)9.8 / 10 × 3029.4In CISA KEV+3030.0EPSS percentile 99.0.990 × 2019.8Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

Remote command execution due to use of default passwords. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 5.0.1-61, Acronis Cyber Infrastructure (ACI) before build 5.1.1-71, Acronis Cyber Infrastructure (ACI) before build 5.2.1-69, Acronis Cyber Infrastructure (ACI) before build 5.3.1-53, Acronis Cyber Infrastructure (ACI) before build 5.4.4-132.

Affected

ProductAffectedFixed inSource
Acronis Cyber Infrastructureunspecified – < 5.0.1-615.0.1-61CNA
Acronis Cyber Infrastructureunspecified – < 5.1.1-715.1.1-71CNA
Acronis Cyber Infrastructureunspecified – < 5.2.1-695.2.1-69CNA
Acronis Cyber Infrastructureunspecified – < 5.3.1-535.3.1-53CNA
Acronis Cyber Infrastructureunspecified – < 5.4.4-1325.4.4-132CNA
cyber_infrastructure< 5.0.1-615.0.1-61CISA-ADP
cyber_infrastructure5.1.1 – < 5.1.1-715.1.1-71CISA-ADP
cyber_infrastructure5.2.1 – < 5.2.1-695.2.1-69CISA-ADP
cyber_infrastructure5.3.1 – < 5.3.1-535.3.1-53CISA-ADP
cyber_infrastructure5.4.4 – < 5.4.4-1325.4.4-132CISA-ADP
cyber_infrastructure< 5.0.1-615.0.1-61CISA-ADP
cyber_infrastructure5.1.1 – < 5.1.1-715.1.1-71CISA-ADP

Scores by source

Acronis (CNA)9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

advisorysecurity-advisory.acronis.com/advisories/SEC-6452refsecurityweek.com/acronis-product-vulnerability-exploited-in-the-wildrefcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-45249kevcisa.gov/known-exploited-vulnerabilities-catalog