PT-2024-5232 · Acronis · Acronis Cyber Infrastructure

Published 2024-07-24 · Updated 2025-10-22 · CVE-2023-45249

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Acronis Cyber Infrastructure (ACI) versions prior to 5.0.1-61 Acronis Cyber Infrastructure (ACI) versions prior to 5.1.1-71 Acronis Cyber Infrastructure (ACI) versions prior to 5.2.1-69 Acronis Cyber Infrastructure (ACI) versions prior to 5.3.1-53 Acronis Cyber Infrastructure (ACI) versions prior to 5.4.4-132

Description: The issue is related to the use of default passwords in Acronis Cyber Infrastructure (ACI), allowing a remote attacker to execute arbitrary code. This can lead to remote command execution. The estimated number of potentially affected devices is not confirmed, but it is reported that there are probably quite a few large companies using ACI. The vulnerability has been exploited in the wild to install a cryptominer.

Recommendations: For versions prior to 5.0.1-61, update to a version after 5.0.1-61 to resolve the issue. For versions prior to 5.1.1-71, update to a version after 5.1.1-71 to resolve the issue. For versions prior to 5.2.1-69, update to a version after 5.2.1-69 to resolve the issue. For versions prior to 5.3.1-53, update to a version after 5.3.1-53 to resolve the issue. For versions prior to 5.4.4-132, update to a version after 5.4.4-132 to resolve the issue. As a temporary workaround, consider restricting access to the default password-protected areas until a patch is available.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

CWE-1393

Related Identifiers

BDU:2024-05799

CVE-2023-45249

Affected Products

Acronis Cyber Infrastructure

References · 29

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/acronis_cyber_infra_cve_2023_45249.rb · Exploit
• https://osv.dev/vulnerability/CVE-2023-45249 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-05799 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-45249 · Security Note
• https://t.me/avleonovcom/1404 · Telegram Post
• https://security-advisory.acronis.com/advisories/SEC-6452 · Vendor Advisory, Security Note
• https://t.me/zerodayalert/285 · Telegram Post
• https://security-advisory.acronis.com/updates/UPD-2310-9e7e-bd9b · Note
• https://t.me/pentestingnews/49551 · Telegram Post
• https://t.me/cvenotify/87839 · Telegram Post
• https://t.me/true_secator/6076 · Telegram Post
• https://twitter.com/leonov_av/status/1825134399051940042 · Twitter Post
• https://t.me/zerodayalert/289 · Telegram Post
• https://vuldb.com/?id.272362 · Note
• https://securityweek.com/acronis-product-vulnerability-exploited-in-the-wild · Note