PT-2025-38737 · Airship Ai · Airship Ai Acropolis

Published 2025-09-22 · Updated 2025-12-19 · CVE-2025-35041

Positive Technologies (AI Summary)

CVSS v4.0

7.7

High

Base vector

AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Airship AI Acropolis versions prior to 10.2.35 Airship AI Acropolis versions prior to 11.0.21 Airship AI Acropolis versions prior to 11.1.9

Description The software permits an unlimited number of multi-factor authentication (MFA) attempts within a 15-minute window following successful user login with valid credentials. This allows a remote attacker, possessing valid user credentials, to potentially brute-force the 6-digit MFA code.

Recommendations Update to version 10.2.35 or later. Update to version 11.0.21 or later. Update to version 11.1.9 or later.

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2025-35041

Affected Products

Airship Ai Acropolis

References · 6

• https://cve.org/CVERecord?id=CVE-2025-35041 · Security Note
• https://osv.dev/vulnerability/CVE-2025-35041 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-35041 · Security Note
• https://twitter.com/CVEnew/status/1970160919243088039 · Twitter Post
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-265-01.json · Note
• https://t.me/cveNotify/146320 · Telegram Post