CVE-2023-45249
Published: July 29, 2024
Official Description
Acronis Cyber Infrastructure (ACI) allows an unauthenticated user to execute commands remotely due to the use of default passwords.
CISA KEV Advisory
Acronis Cyber Infrastructure (ACI) Insecure Default Password Vulnerability
Acronis Cyber Infrastructure (ACI) allows an unauthenticated user to execute commands remotely due to the use of default passwords.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Risk Analysis
Acronis Cyber Infrastructure (ACI) is vulnerable to remote command execution by unauthenticated users due to the use of default passwords. This high-severity flaw, with an EPSS score of 0.93342 and inclusion in CISA's KEV, represents a critical and easily exploitable risk.
This vulnerability is actively being exploited in the wild. The use of default passwords allows for straightforward remote command execution by unauthenticated attackers.
Administrators must immediately change all default passwords in Acronis Cyber Infrastructure. Implement strong password policies and regularly audit for default or weak credentials.
Technical Analysis
CVE-2023-45249 requires local access, meaning attackers must already have a foothold on the target system.
Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.
CISA has added CVE-2023-45249 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.
Exploit & PoC Resources
All References (2)
Quick Facts
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2023-45249 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts
- !CISA KEV: Federal agencies must patch per BOD 22-01 timeline
- !Active exploitation confirmed — treat as P1