CVE-2023-45249

What it actually does

CVE-2023-45249 is a network-exploitable remote command execution vulnerability in Acronis Cyber Infrastructure caused by the use of default passwords. An unauthenticated remote attacker can authenticate with known default credentials and execute commands on affected ACI systems. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact, successful exploitation can allow full system compromise, data access, service disruption, and attacker-controlled changes to the infrastructure platform.

Why it matters to the business

Affected Acronis Cyber Infrastructure deployments are at high risk because the vulnerability is actively exploited in the wild and is listed in CISA KEV with a remediation due date of 2024-08-19. Compromise of ACI can affect backup, storage, virtualization, or infrastructure services that organizations rely on for resilience and recovery. Business consequences may include data theft, destruction or tampering, outage of infrastructure services, loss of backup integrity, impaired disaster recovery capability, and the need for incident response and rebuild activity. Although CISA does not mark this CVE as known to be used in ransomware campaigns, the level of access provided by remote command execution makes it suitable for follow-on ransomware or destructive activity.

How an attack unfolds

An attacker scans the internet or internal network for exposed Acronis Cyber Infrastructure services. If the target is running an affected build and still accepts default credentials, the attacker authenticates using those credentials. After gaining access, the attacker uses available administrative or service interfaces to execute operating-system commands or deploy tooling. From there, the attacker may enumerate the appliance or cluster, collect credentials or configuration data, modify infrastructure settings, access stored data, create persistence, disable security controls, or use the compromised system as a foothold for lateral movement. Active exploitation has been reported, so exposed unpatched systems should be treated as high-priority investigation targets, not merely patching candidates.

How to fix it

Upgrade Acronis Cyber Infrastructure to a fixed build for the installed release line: 5.0.1-61 or later, 5.1.1-71 or later, 5.2.1-69 or later, 5.3.1-53 or later, or 5.4.4-132 or later. If upgrading immediately is not possible, remove external exposure, restrict access to management interfaces with VPN, firewall rules, or allowlists, rotate any default or shared credentials, enforce unique strong passwords, disable unused accounts and services, and monitor aggressively for suspicious command execution. Because the flaw is in CISA KEV and exploitation is active, mitigation should be treated as temporary only; the durable fix is upgrading to a corrected build and validating that default credentials are no longer accepted.

How to confirm the fix worked

Confirm the running Acronis Cyber Infrastructure build is at or above the fixed build for its release branch: 5.0.1-61, 5.1.1-71, 5.2.1-69, 5.3.1-53, or 5.4.4-132. Verify that management and service interfaces are not exposed to untrusted networks. Confirm default credentials no longer authenticate and that all local, administrative, and service accounts have unique strong passwords. Review access controls to ensure only expected administrative sources can reach ACI management services. Perform vulnerability scanning or authenticated configuration review where supported, and validate that no unauthorized accounts, scheduled jobs, startup scripts, SSH keys, web-accessible files, or unexpected processes remain after remediation.

Typical attack path

1. Identify internet-facing or network-reachable Acronis Cyber Infrastructure services.
2. Fingerprint the product and version/build where possible.
3. Attempt authentication using known default credentials.
4. Gain administrative or service-level access without prior legitimate credentials.
5. Execute commands through the exposed management or service interface.
6. Deploy scripts, web shells, reverse shells, or other post-exploitation tooling.
7. Enumerate stored data, credentials, backup/storage configuration, cluster members, and network reachability.
8. Create persistence, alter accounts or settings, disable logging or defenses, and pivot to adjacent systems.

How to detect it

Review Acronis Cyber Infrastructure application, management, authentication, system, SSH, web server, and audit logs for successful logins using default or unexpected accounts, especially from unfamiliar IP addresses. Look for authentication successes immediately followed by command execution, configuration changes, file uploads, account creation, SSH key additions, service restarts, scheduled task creation, or outbound network connections. On Linux-based components, examine /var/log/auth.log, /var/log/secure, journalctl output, shell histories, cron directories, systemd unit changes, SSH authorized_keys files, and recently modified files in web-accessible or administrative directories. Network telemetry should be reviewed for scanning against ACI management ports, anomalous administrative sessions, reverse-shell-like outbound connections, and connections from known malicious infrastructure. Because exploitation is active in the wild, any exposed affected build with default credentials enabled should be investigated for compromise even if no alert has fired.

• Acronis Cyber Infrastructure build 5.0.1-60 or earlier
• Acronis Cyber Infrastructure build 5.1.1-70 or earlier
• Acronis Cyber Infrastructure build 5.2.1-68 or earlier
• Acronis Cyber Infrastructure build 5.3.1-52 or earlier
• Acronis Cyber Infrastructure build 5.4.4-131 or earlier
• /var/log/auth.log
• /var/log/secure
• /var/log/audit/audit.log
• /root/.ssh/authorized_keys
• /home/*/.ssh/authorized_keys
• /etc/cron.d/
• /etc/crontab
• /var/spool/cron/
• /etc/systemd/system/
• /tmp/
• /var/tmp/
• /dev/shm/
• authorized_keys
• Failed password
• Accepted password
• Accepted publickey
• sudo:
• COMMAND=
• useradd
• adduser
• usermod
• chpasswd
• passwd
• curl http
• wget http
• bash -i
• /bin/sh -i
• nc -e
• ncat -e
• python -c
• python3 -c
• perl -e
• php -r
• chmod +x
• nohup
• setsid
• crontab -e
• systemctl enable
• systemctl start

What your security team should do

• Immediately inventory all Acronis Cyber Infrastructure deployments and identify their build numbers and network exposure.
• Prioritize remediation of any internet-facing or broadly reachable ACI systems because exploitation is active in the wild and the CVSS score is critical.
• Upgrade affected systems to the appropriate fixed build: 5.0.1-61, 5.1.1-71, 5.2.1-69, 5.3.1-53, or 5.4.4-132 or later.
• If patching cannot be completed immediately, block untrusted access to ACI management interfaces and allow only trusted administrative networks.
• Rotate all default, shared, administrative, and service credentials associated with ACI and related infrastructure.
• Hunt for evidence of prior compromise, including successful default-credential logins, unexpected command execution, newly created accounts, added SSH keys, persistence mechanisms, and suspicious outbound connections.
• Preserve relevant logs before upgrading or rebuilding systems, as attackers may attempt to clear evidence.
• If exploitation is suspected, isolate the affected node or cluster segment, collect forensic artifacts, rotate credentials that may have been exposed, and assess backup/storage integrity before returning systems to service.