Actively exploited · Published Jul 24, 2024 · Assigned by Acronis
CVE-2023-45249
Critical 9.8 Exploited
In plain English
A critical-severity security flaw in Acronis Cyber Infrastructure from Acronis. Attackers are actively exploiting it in the wild (listed by CISA on July 29, 2024). The chance it is exploited in the next 30 days is estimated at 53.5% (higher than 99% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Aug 19, 2024.
Official description
Remote command execution due to use of default passwords. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 5.0.1-61, Acronis Cyber Infrastructure (ACI) before build 5.1.1-71, Acronis Cyber Infrastructure (ACI) before build 5.2.1-69, Acronis Cyber Infrastructure (ACI) before build 5.3.1-53, Acronis Cyber Infrastructure (ACI) before build 5.4.4-132.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Acronis | Acronis Cyber Infrastructure | unspecified – before 5.0.1-61 |
| Acronis | Acronis Cyber Infrastructure | unspecified – before 5.1.1-71 |
| Acronis | Acronis Cyber Infrastructure | unspecified – before 5.2.1-69 |
| Acronis | Acronis Cyber Infrastructure | unspecified – before 5.3.1-53 |
| Acronis | Acronis Cyber Infrastructure | unspecified – before 5.4.4-132 |
Weakness: CWE-1393 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H