Acronis Releases Critical Security Advisory - 20240729001 (#909)

* Acronis Releases Critical Security Advisory - 20240729001 * Update 20240729001 Restructure of information --------- Co-authored-by: JadonWill <117053393+JadonWill@users.noreply.github.com>
wagov · Jul 29, 2024 · 75fcb1d · 75fcb1d
1 parent a0e2e5d
commit 75fcb1d
Show file tree

Hide file tree

Showing 2 changed files with 22 additions and 0 deletions.
diff --git a/docs/advisories/"https:/nvd.nist.gov/vuln/detail/CVE-2021-35515" b/docs/advisories/"https:/nvd.nist.gov/vuln/detail/CVE-2021-35515"
diff --git a/docs/advisories/20240729001-Acronis-Releases-Critical-Security-Advisory.md b/docs/advisories/20240729001-Acronis-Releases-Critical-Security-Advisory.md
@@ -0,0 +1,22 @@
+# Acronis Releases Critical Security Advisory - 20240729001
+
+## Overview
+
+Acronis has released a critical advisory related to a vulnerability found in their Acronis Cyber Infrastructure (ACI) product that could allow attackers to bypass authentication on vulnerable servers using default credentials.
+
+## What is vulnerable?
+
+| Product(s) Affected | Version(s) | CVE | CVSS | Severity |
+| --- | --- | --- | --- | --- |
+| Acronis Cyber Infrastructure (ACI) | 5.0.1 before build -61 </br> 5.1.1 before build -71 </br> 5.2.1 before build -69 </br> 5.3.1 before build -53 </br> 5.4.4 before build -132 | [CVE-2023-45249](https://nvd.nist.gov/vuln/detail/CVE-2023-45249) | 9.8 | **Critical** |
+
+
+## Recommendation
+
+The WA SOC recommends administrators apply the solutions as per vendor instructions to all affected devices within expected timeframe of *48 hours...* (refer [Patch Management](../guidelines/patch-management.md)):
+
+- Acronis advisory: <https://security-advisory.acronis.com/advisories/SEC-6452>
+
+## Additional References
+
+- BleepingComputer article: <https://www.bleepingcomputer.com/news/security/acronis-warns-of-cyber-infrastructure-default-password-abused-in-attacks/>