Airship AI MFA bypass and default credentials vulnerabilities
Advisory ansehen veröffentlicht 2025-09-22
Airship AI Acropolis is used for video and data management. In versions before 11.1.9, 11.0.21, and 10.2.35, a remote unauthenticated attacker with valid credentials can brute force the MFA code and authenticate without an additional authentication method. Improperly configured systems could also allow an attacker to log in with unchanged default credentials.
01
beschreibt (2)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-35042US | —OT erhöht | — | ||
Airship AI Acropolis includes a default administrative account that uses the same credentials on every installation. Instances of Airship AI that do not change this account passwor… | ||||
| CVE-2025-35041US | — | — | ||
Airship AI Acropolis allows unlimited MFA attempts for 15 minutes after a user has logged in with valid credentials. A remote attacker with valid credentials could brute-force the… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
03
Behebungen (2)
- BehobenAcropolis
Fixed in 10.2.35, 11.0.21, and 11.1.9.
- BehobenAcropolis
Fixed in 10.2.35, 11.0.21, and 11.1.9.
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan