CVE-2023-45249

🗓️ 24 Jul 2024 14:03:56Reported by AcronisType

Remote command execution due to default passwords in Acronis Cyber Infrastructure product

Reporter	Title	Published	Views	Family All 19
0day.today	Acronis Cyber Infrastructure Default Password Remote Code Execution Exploit	3 Oct 202400:00	–	zdt
Tenable Nessus	Acronis Cyber Infrastructure 5.1.x < 5.1.1-71 / 5.2.x < 5.2.1-69 / 5.3.x < 5.3.1-53 / 5.4.x < 5.4.4-132 / < 5.0.1-61 (SEC-6452)	23 Aug 202400:00	–	nessus
ATTACKERKB	CVE-2023-45249	24 Jul 202400:00	–	attackerkb
BDU FSTEC	The vulnerability of the software platform for remote management of endpoints, backup, and virtualization in Acronis Cyber Infrastructure (ACI) arises from the use of pre-installed credentials. This allows a malicious actor to execute arbitrary code.	29 Jul 202400:00	–	bdu_fstec
Circl	CVE-2023-45249	24 Jul 202416:38	–	circl
CISA KEV Catalog	Acronis Cyber Infrastructure (ACI) Insecure Default Password Vulnerability	29 Jul 202400:00	–	cisa_kev
CISA	CISA Adds Three Known Exploited Vulnerabilities to Catalog	29 Jul 202412:00	–	cisa
CNNVD	Acronis Cyber Infrastructure 安全漏洞	24 Jul 202400:00	–	cnnvd
CVE	CVE-2023-45249	24 Jul 202414:03	–	cve
Metasploit	Acronis Cyber Infrastructure default password remote code execution	3 Oct 202418:54	–	metasploit

[
  {
    "vendor": "Acronis",
    "product": "Acronis Cyber Infrastructure",
    "platforms": [
      "ACI"
    ],
    "versions": [
      {
        "version": "unspecified",
        "status": "affected",
        "lessThan": "5.0.1-61",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "Acronis",
    "product": "Acronis Cyber Infrastructure",
    "platforms": [
      "ACI"
    ],
    "versions": [
      {
        "version": "unspecified",
        "status": "affected",
        "lessThan": "5.1.1-71",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "Acronis",
    "product": "Acronis Cyber Infrastructure",
    "platforms": [
      "ACI"
    ],
    "versions": [
      {
        "version": "unspecified",
        "status": "affected",
        "lessThan": "5.2.1-69",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "Acronis",
    "product": "Acronis Cyber Infrastructure",
    "platforms": [
      "ACI"
    ],
    "versions": [
      {
        "version": "unspecified",
        "status": "affected",
        "lessThan": "5.3.1-53",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "Acronis",
    "product": "Acronis Cyber Infrastructure",
    "platforms": [
      "ACI"
    ],
    "versions": [
      {
        "version": "unspecified",
        "status": "affected",
        "lessThan": "5.4.4-132",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
securityweek	www.securityweek.com/acronis-product-vulnerability-exploited-in-the-wild/
security-advisory	www.security-advisory.acronis.com/advisories/SEC-6452

29 Jul 2024 22:26Current

CVSS 39.8

EPSS0.9348

CWE-1393