CVE-2023-45249criticalunder attackCWE-1393

CVE-2023-45249: critical vulnerability in Acronis Cyber Infrastructure

Published · Updated

Follow this CVE+ Monitor Acronis Cyber Infrastructure

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

85Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 54%
from disclosure to weaponsame day
Published on NVDJul 24
metasploitJul 24
CISA KEV+5d
Action required by CISAfederal deadline: 2024-08-19

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

Acronis Cyber Infrastructure allows attackers to execute commands remotely by using default passwords that were not changed during installation. This is critical because an attacker can gain full control of the system without needing to guess or crack passwords.

Technical detail

CWE-1393 involves use of hard-coded or default credentials in Acronis Cyber Infrastructure (ACI) across multiple versions, enabling unauthenticated remote command execution. An attacker with network access can leverage these default credentials to authenticate and execute arbitrary commands with system privileges. Affected versions include ACI 5.0.x, 5.1.x, 5.2.x, 5.3.x, and 5.4.x prior to specified patch levels.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Remote command execution due to use of default passwords. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 5.0.1-61, Acronis Cyber Infrastructure (ACI) before build 5.1.1-71, Acronis Cyber Infrastructure (ACI) before build 5.2.1-69, Acronis Cyber Infrastructure (ACI) before build 5.3.1-53, Acronis Cyber Infrastructure (ACI) before build 5.4.4-132.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Acronis · Acronis Cyber Infrastructure
Related CVEs — Acronis Cyber Infrastructure

In the same product, most dangerous first.

CVE-2023-2360LOWCVE-2023-2360EPSS 0.4%CVE-2026-87095CRITICALCVE-2026-87095EPSS 0.2%CVE-2023-2782MEDIUMCVE-2023-2782EPSS 0.2%CVE-2026-87096LOWCVE-2026-87096EPSS 0.1%