Insecure Default Password in Acronis Cyber Infrastructure (ACI) (CVE‑2023‑45249) Enables Remote Command Execution
What It Is — Acronis Cyber Infrastructure (ACI) ships with a hard‑coded default password. If the password is not changed, an unauthenticated attacker can log in to the management interface and execute arbitrary commands. The flaw is cataloged as CVE‑2023‑45249.
Exploitability — The vulnerability is exploitable without any credentials; proof‑of‑concept code is publicly available. CVSS v3.1 base score 9.1 (High).
Affected Products — All Acronis Cyber Infrastructure (ACI) deployments that have not applied the vendor‑issued remediation patch (see Acronis advisory).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous verification that default credentials are removed during provisioning—a control that maps to many frameworks simultaneously.
- Lack of credential hygiene creates audit gaps; evidence of remediation (password‑change logs, MFA enrollment) is required for a defensible compliance posture.
- Enterprise buyers now demand proof that access‑control processes are enforced and monitored in real time, not just a one‑time checklist.
Recommended Actions
- Immediately rotate any default passwords on ACI instances and enforce strong, unique credentials.
- Enable multi‑factor authentication where supported and integrate ACI into your privileged‑access‑management solution.
- Capture remediation evidence (password‑change logs, MFA enrollment records) for audit readiness.
- Apply the vendor‑released security patch and monitor for anomalous activity.
Source: https://nvd.nist.gov/vuln/detail/CVE-2023-45249