PT-2025-38737 · Airship Ai · Airship Ai Acropolis
CVE-2025-35041
·
Published
2025-09-22
·
Updated
2025-12-19
CVSS v4.0
7.7
High
| Vector | AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
Airship AI Acropolis versions prior to 10.2.35
Airship AI Acropolis versions prior to 11.0.21
Airship AI Acropolis versions prior to 11.1.9
Description
The software permits an unlimited number of multi-factor authentication (MFA) attempts within a 15-minute window following successful user login with valid credentials. This allows a remote attacker, possessing valid user credentials, to potentially brute-force the 6-digit MFA code.
Recommendations
Update to version 10.2.35 or later.
Update to version 11.0.21 or later.
Update to version 11.1.9 or later.
Fix
Improper Restriction of Excessive Authentication Attempts
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Airship Ai Acropolis