Critical Flaw in Acronis Cyber Infrastructure Exploited in the Wild
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-45249 | Default-Password Remote Command Execution in Acronis Cyber Infrastructure CVE-2023-45249 is an insecure default password flaw (CWE-1393) in Acronis Cyber Infrastructure (ACI) that allows unauthenticated remote command execution with a CVSS 3.1 score of 9.8. An attacker who can reach the exposed service over the network can authenticate with credentials left at vendor defaults and run arbitrary commands, gaining full confidentiality, integrity, and availability impact on the host. Organizations running ACI 5.0, 5.1, 5.2, 5.3, or 5.4 on builds earlier than the fixed builds are affected, particularly deployments where the ACI management interface is internet-facing. The flaw is actively exploited in the wild: it was added to CISA's Known Exploited Vulnerabilities catalog on 2024-07-29 and multiple security outlets reported in-the-wild exploitation, with an EPSS of 53.3% (99th percentile). No public proof-of-concept is known, but exploitation activity has been observed directly. Do: Upgrade each affected ACI deployment to the fixed build for its branch: at least 5.0.1-61, 5.1.1-71, 5.2.1-69, 5.3.1-53, or 5.4.4-132 respectively. Immediately change any account or service passwords still set to vendor defaults, and restrict internet exposure of the ACI management interface. Per CISA's KEV required action, apply vendor mitigations (or discontinue use if unavailable), and review logs for signs of unauthorized access or command execution. | 9.8 | 53% | KEV |
| moderateon the order of 1,000-10,000 exposed ACI instances (estimate) |
Full article386 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananJul 29, 2024Enterprise Security / Data Protection
Cybersecurity company Acronis is warning that a now-patched critical security flaw impacting its Cyber Infrastructure (ACI) product has been exploited in the wild.
The vulnerability, tracked as CVE-2023-45249 (CVSS score: 9.8), concerns a case of remote code execution that stems from the use of default passwords.
The flaw impacts the following versions of Acronis Cyber Infrastructure (ACI) -
- < build 5.0.1-61
- < build 5.1.1-71
- < build 5.2.1-69
- < build 5.3.1-53, and
- < build 5.4.4-132
It has been addressed in versions 5.4 update 4.2, 5.2 update 1.3, 5.3 update 1.3, 5.0 update 1.4, and 5.1 update 1.2 released in late October 2023.
There are currently no details on how the vulnerability is being weaponized in real-world cyber attacks and the identity of the threat actors that may be exploiting it.
However, the Swiss-headquartered company acknowledged reports of active exploitation in an updated advisory last week. "This vulnerability is known to be exploited in the wild," it said.
Users of affected versions of ACI are recommended to update to the latest version to mitigate potential threats.
Update
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added CVE-2023-45249 to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to remediate the flaw by August 19, 2024.
In a statement shared with The Hacker News following the publication of the story, Acronis said that the vulnerability was discovered and patched nine months ago.
"Customers running the older version of Acronis Cyber Infrastructure impacted by the vulnerability were promptly informed, provided a patch and recommended upgrading to the new version," it said. Acronis Cyber Protect Cloud, Acronis Cyber Protect and Acronis True Image customers were not affected by the vulnerability."
"The Acronis support team received a request from a customer of Acronis Cyber Infrastructure about performance degradation. During the initial investigation, the Acronis team discovered crypto-mining software. After a prompt investigation by the security team, the vulnerability used to install the crypto-mining software was discovered, and a patch was released and delivered to the customer."
(The story was updated after publication to include details of exploitation activity shared by Acronis.)
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2024/07/critical-flaw-in-acronis-cyber.html