CVE-2023-45249: Acronis Cyber Infrastructure (ACI) Insecure Default Password Vulnerability

CVE-2023-45249 is an insecure default password issue in Acronis Cyber Infrastructure (ACI). Because default credentials are present, an unauthenticated remote attacker can gain access and execute commands on the system. This matters for IT and security teams because ACI often sits in storage, backup, or infrastructure layers; successful abuse can give an attacker a foothold for further movement, data access, or disruption of recovery capabilities.

Public detail is limited to the CISA summary and the CWE classification. Confirm exact product builds, fixed releases, and configuration guidance against the vendor advisory before acting.

How it works

The weakness is classified as CWE-1393, which covers the use of default passwords. In this case, Acronis Cyber Infrastructure ships or retains credentials that are known or easily guessed. An attacker who can reach the management or service interface simply authenticates with those defaults and then issues commands as if they were a legitimate administrator.

No further exploit mechanics are provided in the available facts. The practical result is remote command execution without prior authentication. Defenders should treat any exposed ACI management plane that still uses factory credentials as fully compromised once an attacker reaches it. Specific authentication endpoints, protocols, or command channels must be verified in the vendor advisory rather than assumed.

Am I affected? How to find it in your systems

Acronis Cyber Infrastructure is typically deployed as a software-defined storage or hyper-converged platform supporting backup, object storage, or virtualization workloads. It commonly runs on dedicated appliance-like servers or clusters inside data centers and private clouds.

• Inventory: Search configuration management databases, asset inventories, and network scans for hosts or clusters labeled Acronis Cyber Infrastructure, ACI, or related Acronis storage components. Check management IP ranges and any self-service portals that expose ACI.
• Version and configuration check: Identify installed software versions and whether default administrative accounts remain enabled or unchanged. Exact vulnerable versions are not listed in the supplied facts; compare your build numbers directly against the vendor advisory.
• Credential audit: Attempt (in a controlled, authorized manner) to log in with documented factory defaults or review password-history and account-status settings. Any successful default login indicates exposure.
• Telemetry signs: Look for successful authentications from unexpected source IPs, especially those using administrative accounts shortly after network discovery activity. Monitor for subsequent command or configuration changes, new user creation, or unusual process execution on ACI nodes. Correlate with firewall or VPN logs showing inbound access to management ports.

If you cannot confirm version or credential state, treat the instance as potentially affected until verified.

How to remediate

Patch first. Apply the vendor-supplied update or configuration changes named in the Acronis advisory for CVE-2023-45249. CISA’s required action is to apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

• After applying the update, force a password change on all administrative and service accounts; remove or disable any remaining default accounts.
• Re-validate that management interfaces no longer accept the previous factory credentials.
• Harden the broader class of default-credential weaknesses: enforce unique, complex passwords at first boot, integrate with enterprise identity providers where supported, and disable unused management protocols.
• Document the change window and re-scan the environment to confirm no residual default-password instances remain.

Do not rely on generic “change password” advice alone; follow the precise steps and package names given by the vendor.

If you can't patch immediately

Reduce the attack surface until the official fix can be applied.

• Network segmentation: Place ACI management interfaces on isolated VLANs or management networks reachable only from jump hosts or bastion servers. Block direct internet or untrusted-network access to those ports.
• Access control: Restrict source IP ranges via firewall rules or host-based firewalls. Require multi-factor authentication on any jump host that can reach ACI.
• Feature disablement: If the product allows, turn off remote management services or web consoles that are not strictly required until credentials are rotated and the patch is installed.
• Virtual patching / monitoring: Deploy IDS/IPS or WAF rules that flag or block attempts to authenticate with known default credential patterns, if such signatures exist for the product. Increase logging verbosity for authentication events and forward them to a SIEM for real-time alerting.
• Discontinue use: If no mitigation path is available and the system cannot be isolated, follow the CISA guidance to discontinue use until a secure configuration is possible.

These controls buy time; they do not replace the vendor update.

If your data may have been exposed

Actively exploited vulnerabilities of this class frequently lead to full system compromise and subsequent data access or ransomware staging, although ransomware use is not documented for this specific CVE. If logs show successful default-credential logins or unexplained command activity, treat the ACI environment and any attached storage as potentially breached. Isolate the systems, preserve forensic images, rotate all credentials that may have been accessible from the platform, and begin incident-response procedures. As a quick personal check, you can run a free exposure scan of your email address against known breach data sets to see whether related accounts appear in public dumps.