Executive Summary

This vulnerability in Airship AI Acropolis allows an attacker who has valid user credentials to attempt unlimited Multi-Factor Authentication (MFA) codes for 15 minutes after login. Specifically, the attacker can brute-force the 6-digit MFA code during this time window, bypassing normal MFA attempt limits.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can allow a remote attacker with valid credentials to bypass MFA protections by brute-forcing the 6-digit MFA code within 15 minutes after login. This can lead to unauthorized access to user accounts, potentially compromising sensitive data and system integrity.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, immediately update Airship AI Acropolis to one of the fixed versions: 10.2.35, 11.0.21, or 11.1.9. Until the update is applied, consider restricting access to the system, monitoring for unusual MFA attempts, and enforcing additional security controls to limit brute-force attempts on the 6-digit MFA code.

Useful 0 Not Useful 0