Skip to content
Log inStart free trial

CVE-2023-45249

Remote command execution due to use of default passwords.

Critical Known exploited
Severity
9.8 / 10
Critical · CVSS 3.1
Exploit chance (EPSS)
53.25%
Chance of exploitation in the next 30 days. Higher than 98.98% of scored vulnerabilities.
Known exploited
Yes
In CISA's catalog since Jul 29, 2024
Weakness
CWE-1393 Use of Default Password
Fix
None yet
No fixed version published
Exploited in the wild. Acronis Cyber Infrastructure (ACI) Insecure Default Password Vulnerability (Acronis Cyber Infrastructure (ACI)). Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Due for U.S. federal agencies by Aug 19, 2024.

Description

Remote command execution due to use of default passwords. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 5.0.1-61, Acronis Cyber Infrastructure (ACI) before build 5.1.1-71, Acronis Cyber Infrastructure (ACI) before build 5.2.1-69, Acronis Cyber Infrastructure (ACI) before build 5.3.1-53, Acronis Cyber Infrastructure (ACI) before build 5.4.4-132.

How to fix

No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.

Severity breakdown

CVSS 3.1 9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Weakness

CWE-1393: Use of Default Password

The product uses default passwords for potentially critical functionality.

How to prevent it
  • Requirements: Prohibit use of default, hard-coded, or other values that do not vary for each installation of the product - especially for separate organizations.
  • Documentation: Ensure that product documentation clearly emphasizes the presence of default passwords and provides steps for the administrator to change them.
  • Architecture and Design: Force the administrator to change the credential upon installation.
  • Installation, Operation: The product administrator could change the defaults upon installation or during operation.

References

Advisories

Other links

Timeline

  1. Published
  2. Added to CISA's Known Exploited Vulnerabilities catalog
  3. Remediation due for U.S. federal agencies
  4. Last updated by the source
  5. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-hj7x-hmf2-hc2p
Harbor allows the use of the default password for web UI login
Critical Same weakness, CWE-1393
GHSA-gq3w-7jj3-x7gr
MLflow Use of Default Password Authentication Bypass Vulnerability
High Same weakness, CWE-1393
GHSA-43xf-59vr-g4f2
Liferay Portal Uses Default Password
Medium Same weakness, CWE-1393
GHSA-57qh-vmjr-5jxg
Snipe-IT remote code execution
Medium Same weakness, CWE-1393
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor