How severe is CVE-2023-45249?

CVE-2023-45249 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2023-45249 being actively exploited?

Yes. CVE-2023-45249 is on CISA's Known Exploited Vulnerabilities (KEV) catalog, added on 2024-07-29, which means active exploitation has been confirmed. It should be prioritised for remediation.

What products are affected by CVE-2023-45249?

CVE-2023-45249 affects Acronis Cyber Infrastructure. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2023-45249?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Because this CVE is known to be actively exploited, treat remediation as urgent — CISA KEV typically sets a short remediation deadline.

Does CVE-2023-45249 have an EU (EUVD) identifier?

Yes. CVE-2023-45249 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2023-49555. It is also flagged as exploited in the EUVD (since 2024-07-29).

When was CVE-2023-45249 published?

CVE-2023-45249 was published on 2024-07-24 and last updated on 2026-06-17.

CVE-2023-45249

CVE-2023-45249 is a critical-severity vulnerability in Acronis Cyber Infrastructure with a CVSS 3.x base score of 9.8. It is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming it has been exploited in the wild (added 2024-07-29). The underlying weakness is classified as CWE-1393.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
EPSS exploit prediction: 53% (99th percentile)
Actively exploited: Yes — listed in CISA KEV (added 2024-07-29)
EU (EUVD) id: EUVD-2023-49555
EU exploitation: Flagged exploited in the ENISA EU Vulnerability Database (since 2024-07-29)
Weakness: CWE-1393
Affected product: Acronis Cyber Infrastructure
Published: 2024-07-24
Last modified: 2026-06-17

Description

Remote command execution due to use of default passwords. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 5.0.1-61, Acronis Cyber Infrastructure (ACI) before build 5.1.1-71, Acronis Cyber Infrastructure (ACI) before build 5.2.1-69, Acronis Cyber Infrastructure (ACI) before build 5.3.1-53, Acronis Cyber Infrastructure (ACI) before build 5.4.4-132.

Frequently asked questions

What is CVE-2023-45249?: Remote command execution due to use of default passwords. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 5.0.1-61, Acronis Cyber Infrastructure (ACI) before build 5.1.1-71, Acronis Cyber Infrastructure (ACI) before build 5.2.1-69, Acronis Cyber Infrastructure (ACI) before build 5.3.1-53, Acronis Cyber Infrastructure (ACI) before build 5.4.4-132.
How severe is CVE-2023-45249?: CVE-2023-45249 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2023-45249 being actively exploited?: Yes. CVE-2023-45249 is on CISA's Known Exploited Vulnerabilities (KEV) catalog, added on 2024-07-29, which means active exploitation has been confirmed. It should be prioritised for remediation.
What products are affected by CVE-2023-45249?: CVE-2023-45249 affects Acronis Cyber Infrastructure. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2023-45249?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Because this CVE is known to be actively exploited, treat remediation as urgent — CISA KEV typically sets a short remediation deadline.
Does CVE-2023-45249 have an EU (EUVD) identifier?: Yes. CVE-2023-45249 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2023-49555. It is also flagged as exploited in the EUVD (since 2024-07-29).
When was CVE-2023-45249 published?: CVE-2023-45249 was published on 2024-07-24 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:acronis:cyber_infrastructure:*:*:*:*:*:*:*:*

More vulnerabilities in Acronis Cyber Infrastructure

CVE-2023-2360 — High (CVSS 7.5): Sensitive information disclosure due to CORS misconfiguration. The following products are affected: Acronis Cyber…
CVE-2023-2782 — Medium (CVSS 5.5): Sensitive information disclosure due to improper authorization. The following products are affected: Acronis Cyber…

All CVEs affecting Acronis Cyber Infrastructure →

Other CWE-1393 vulnerabilities

CVE-2025-26701 — Critical (CVSS 10.0): An issue was discovered in Percona PMM Server (OVA) before 3.0.0-1.ova. The default service account credentials can…
CVE-2024-51555 — Critical (CVSS 10.0): Default Credentail vulnerabilities allows access to an Aspect device using publicly available default credentials since…
CVE-2026-35075 — Critical (CVSS 9.8): An unauthenticated remote attacker can recover a default, hard coded password from a firmware image and thus gain full…
CVE-2026-33784 — Critical (CVSS 9.8): A Use of Default Password vulnerability in the Juniper Networks Support Insights (JSI) Virtual Lightweight…
CVE-2026-24429 — Critical (CVSS 9.8): Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) ship with a predefined default password…
CVE-2025-66050 — Critical (CVSS 9.8): Vivotek IP7137 camera with firmware version 0200a by default dos not require to provide any password when logging in as…

Browse all CWE-1393 vulnerabilities →