CVE-2023-45249
Acronis Cyber Infrastructure (ACI) Insecure Default Password Vulnerability
Description
CVE-2023-45249 is a critical remote command execution vulnerability in Acronis Cyber Infrastructure (ACI) caused by the use of default passwords. Affecting multiple ACI versions prior to builds 5.0.1-61, 5.1.1-71, 5.2.1-69, 5.3.1-53, and 5.4.4-132, this flaw allows an unauthenticated remote attacker to execute arbitrary commands on the underlying system. With a CVSS v3.1 base score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), this vulnerability has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of August 19, 2024. The EPSS score of 0.93342 (99.8th percentile) indicates near-certain exploitation probability in the wild.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| acronis | cyber infrastructure | < 5.0.1-61; >= 5.1.1, < 5.1.1-71; >= 5.2.1, < 5.2.1-69; >= 5.3.1, < 5.3.1-53; >= 5.4.4, < 5.4.4-132 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://security-advisory.acronis.com/advisories/SEC-6452(Vendor Advisory)
- https://www.securityweek.com/acronis-product-vulnerability-exploited-in-the-wild/(Press/Media Coverage)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-45249(Third Party Advisory, US Government Resource)
Weakness Type
Default Credentials Leading to Remote Command Execution
CVE-2023-45249 stems from the use of default passwords in Acronis Cyber Infrastructure, a weakness pattern closely related to the use of hard-coded credentials and insufficient authentication controls. The product ships with or retains default credentials that are publicly known or easily guessable, allowing remote attackers to authenticate to the system without legitimate credentials. Once authenticated using these default passwords, the attacker gains the ability to execute arbitrary commands on the infrastructure, effectively achieving full system compromise. This class of vulnerability is particularly dangerous in infrastructure management software because it combines trivial exploitation with maximum impact.
Impact Analysis
Complete Infrastructure Compromise is the primary business consequence of CVE-2023-45249. Acronis Cyber Infrastructure is a hyperconverged infrastructure platform used for managing storage, compute, and networking resources across enterprise environments. Successful exploitation grants the attacker full command execution capability on the underlying infrastructure.
Confidentiality Impact is maximum (C:H). An attacker with command execution access on ACI can read all data managed by the infrastructure, including backup archives, virtual machine images, storage volumes, and configuration files containing credentials for connected systems. In organizations using ACI for backup and disaster recovery, this means exposure of all backed-up data across the enterprise.
Integrity Impact is maximum (I:H). Command execution allows the attacker to modify infrastructure configurations, tamper with backup data, inject malicious code into virtual machine images, and alter system logs to cover their tracks. The attacker could compromise the integrity of disaster recovery processes by corrupting backup archives, leaving the organization unable to recover from future incidents.
Availability Impact is maximum (A:H). The attacker can shut down infrastructure services, destroy storage volumes, disable backup operations, or encrypt data for ransom. Given that ACI manages critical infrastructure components, disruption can cascade across the entire IT environment dependent on these resources.
Exploitation Context: The EPSS score of 0.93342 (99.8th percentile) confirms that this vulnerability is among the most actively targeted. CISA's KEV listing with a remediation deadline of August 19, 2024, underscores the urgency. The ransomware association is listed as "Unknown," but the ease of exploitation and infrastructure-level access make it a prime target for ransomware operators.
Exploit Maturity
CVE-2023-45249 is confirmed as actively exploited in the wild, as documented by its inclusion in CISA's KEV catalog with a mandatory remediation deadline of August 19, 2024. The EPSS score of 0.93342 places it in the 99.8th percentile, indicating it is among the most exploited vulnerabilities in the current threat landscape.
Trivial Exploitation Path: The vulnerability requires no sophisticated exploit development. An attacker simply uses the default credentials to authenticate to the ACI management interface and then executes commands. Default credential lists for infrastructure products are widely circulated in hacking communities and automated scanning tools, making this vulnerability accessible to attackers of any skill level.
Public Awareness: SecurityWeek reported on the active exploitation of this vulnerability, and Acronis published a security advisory (SEC-6452) acknowledging the issue. The combination of public disclosure, confirmed exploitation, and trivial attack complexity makes this a high-priority threat.
Ransomware Association: CISA lists the ransomware status as "Unknown." However, infrastructure management platforms like ACI are high-value targets for ransomware operators because they provide access to backup systems, which attackers specifically target to prevent recovery from ransomware encryption.
Remediation
-
Update Acronis Cyber Infrastructure immediately to the patched builds. Apply the appropriate update based on your version branch: build 5.0.1-61 or later for the 5.0.x branch, build 5.1.1-71 or later for 5.1.x, build 5.2.1-69 or later for 5.2.x, build 5.3.1-53 or later for 5.3.x, or build 5.4.4-132 or later for 5.4.x. Refer to the Acronis security advisory SEC-6452 for download links and upgrade instructions.
-
Change all default credentials on the ACI deployment, including administrative accounts, service accounts, and any API keys or tokens that may have been set to default values. Implement strong, unique passwords for all accounts and enable multi-factor authentication where supported.
-
Audit for signs of compromise by reviewing ACI access logs, command execution history, and network connections for any unauthorized activity. Check for newly created accounts, unexpected configuration changes, modified backup jobs, or unusual outbound network traffic that could indicate data exfiltration or command-and-control communication.
-
Restrict network access to the ACI management interface using firewall rules or network segmentation. The management interface should only be accessible from trusted administrator workstations on a dedicated management network, not from the general corporate network or the internet.
-
Implement credential management policies for all infrastructure components. Use a privileged access management (PAM) solution to rotate credentials regularly, enforce strong password policies, and audit all privileged access to infrastructure management platforms.
Technical Details
CVE-2023-45249 is a remote command execution vulnerability in Acronis Cyber Infrastructure (ACI) caused by the use of default passwords across multiple product versions.
CVSS Vector Breakdown: The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H produces a base score of 9.8. The attack vector is network-based (AV:N), meaning the vulnerability is exploitable remotely. Attack complexity is low (AC:L) because the attacker simply uses known default credentials. No privileges are required (PR:N) since the default credentials provide initial access. No user interaction is needed (UI:N). The scope is unchanged (S:U), and all three impact categories are rated high (C:H/I:H/A:H), reflecting full system compromise.
Attack Mechanism: Acronis Cyber Infrastructure ships with or retains default passwords that are not required to be changed during initial deployment or upgrade. These default credentials are either documented in product manuals, known within the security community, or easily discoverable through automated scanning. An attacker who identifies an ACI instance (typically through network scanning for known management ports) can authenticate using these default credentials. Once authenticated, the attacker gains access to management functions that include the ability to execute system-level commands on the underlying infrastructure nodes.
Affected Version Analysis: The vulnerability spans a wide range of ACI versions: all builds before 5.0.1-61, the 5.1.x branch before 5.1.1-71, the 5.2.x branch before 5.2.1-69, the 5.3.x branch before 5.3.1-53, and the 5.4.x branch before 5.4.4-132. This broad version range suggests that the default credential issue was present for an extended period across multiple major releases, potentially exposing a large number of deployments.
Infrastructure Context: ACI is a hyperconverged infrastructure platform that manages compute, storage, and networking resources. Compromise of this platform gives attackers a foothold in the organization's core infrastructure, potentially affecting all workloads and data managed by the platform, including backup repositories that organizations rely on for disaster recovery.
Frequently Asked Questions
What is CVE-2023-45249?
CVE-2023-45249 is a critical remote command execution vulnerability in Acronis Cyber Infrastructure (ACI) caused by the use of default passwords. An unauthenticated attacker can use these default credentials to gain remote access and execute arbitrary commands on the ACI platform, achieving complete infrastructure compromise.
Which versions of Acronis Cyber Infrastructure are affected?
Multiple version branches are affected: all builds before 5.0.1-61, the 5.1.x branch before build 5.1.1-71, the 5.2.x branch before build 5.2.1-69, the 5.3.x branch before build 5.3.1-53, and the 5.4.x branch before build 5.4.4-132. Organizations should check their current build number and update to the corresponding patched version.
Is CVE-2023-45249 being exploited in the wild?
Yes. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog, confirming active exploitation. The EPSS score of 0.93342 (99.8th percentile) further indicates extremely high exploitation activity. SecurityWeek has reported on confirmed in-the-wild exploitation of this Acronis vulnerability.
How can I protect my Acronis Cyber Infrastructure from this vulnerability?
The most important step is to update to the patched build for your version branch as specified in Acronis security advisory SEC-6452. Additionally, change all default credentials immediately, restrict network access to the management interface, and audit your systems for any signs of prior compromise.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.