Airship AI MFA bypass and default credentials vulnerabilities
view advisory published 2025-09-22
Airship AI Acropolis is used for video and data management. In versions before 11.1.9, 11.0.21, and 10.2.35, a remote unauthenticated attacker with valid credentials can brute force the MFA code and authenticate without an additional authentication method. Improperly configured systems could also allow an attacker to log in with unchanged default credentials.
01
describes (2)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-35042US | —OT elevated | — | ||
Airship AI Acropolis includes a default administrative account that uses the same credentials on every installation. Instances of Airship AI that do not change this account passwor… | ||||
| CVE-2025-35041US | — | — | ||
Airship AI Acropolis allows unlimited MFA attempts for 15 minutes after a user has logged in with valid credentials. A remote attacker with valid credentials could brute-force the… | ||||
02
references
External citations — patches, advisories, analysis.
03
remediations (2)
- FixedAcropolis
Fixed in 10.2.35, 11.0.21, and 11.1.9.
- FixedAcropolis
Fixed in 10.2.35, 11.0.21, and 11.1.9.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan