Remote command execution due to use of default passwords.
Affects Acronis Cyber Infrastructure builds before 5.0.1-61, 5.1.1-71, 5.2.1-69, 5.3.1-53, or 5.4.4-132. Fixed in update releases for each branch. CVSS rates it critical (9.8).
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fixed in 5.0.1-61, 5.1.1-71, 5.2.1-69, 5.3.1-53, 5.4.4-132
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Acronis Cyber Infrastructure (ACI) software is affected by this vulnerability. An attacker who knows the default passwords could remotely run commands on the affected system.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Remote command execution due to use of default passwords. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 5.0.1-61, Acronis Cyber Infrastructure (ACI) before build 5.1.1-71, Acronis Cyber Infrastructure (ACI) before build 5.2.1-69, Acronis Cyber Infrastructure (ACI) before build 5.3.1-53, Acronis Cyber Infrastructure (ACI) before build 5.4.4-132.
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- Acronis Acronis Cyber Infrastructure
From unspecified · fixed in 5.0.1-61
- Acronis Acronis Cyber Infrastructure
From unspecified · fixed in 5.1.1-71
- Acronis Acronis Cyber Infrastructure
From unspecified · fixed in 5.2.1-69
- Acronis Acronis Cyber Infrastructure
From unspecified · fixed in 5.3.1-53
- Acronis Acronis Cyber Infrastructure
From unspecified · fixed in 5.4.4-132
References 2
security-advisory.acronis.com
securityweek.com
Questions about CVE-2023-45249
What does this mean?
The bug comes from default passwords that are still in use. A remote attacker who can use them can run arbitrary code on the affected Acronis Cyber Infrastructure system.Source: securityweek.com
Am I affected, and how do I check?
Acronis Cyber Infrastructure (ACI) builds before 5.0.1-61, 5.1.1-71, 5.2.1-69, 5.3.1-53, and 5.4.4-132 are affected. To check, compare the installed ACI build number against these builds.Source: securityweek.com
What should I do about it?
Update to the fixed release for the installed branch: 5.4 update 4.2, 5.2 update 1.3, 5.3 update 1.3, 5.0 update 1.4, or 5.1 update 1.2. No workaround is listed in the facts.Source: securityweek.com
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2024-07-29, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data