CVE-2025-35042
📋 TL;DR
Airship AI Acropolis uses a default administrative account with identical hardcoded credentials across all installations. Attackers can remotely log in using these credentials to gain administrative privileges on vulnerable systems. This affects all Airship AI Acropolis instances that haven't changed the default account password.
💻 Affected Systems
- Airship AI Acropolis
📦 What is this software?
Acropolis by Airship.ai
Acropolis by Airship.ai
Acropolis by Airship.ai
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to access, modify, or delete sensitive data, deploy malware, pivot to other systems, and disrupt operations.
Likely Case
Unauthorized administrative access leading to data theft, configuration changes, and potential lateral movement within the network.
If Mitigated
No impact if default credentials are changed or systems are patched and properly segmented.
🎯 Exploit Status
Exploitation requires only knowledge of the default credentials, which are identical across installations.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.2.35, 11.0.21, or 11.1.9
Vendor Advisory: https://www.cve.org/CVERecord?id=CVE-2025-35042
Restart Required: Yes
Instructions:
1. Identify your current Airship AI Acropolis version. 2. Upgrade to version 10.2.35, 11.0.21, or 11.1.9 depending on your release track. 3. Restart the application. 4. Verify the default administrative account password has been changed or removed.
🔧 Temporary Workarounds
Change Default Administrative Password
allImmediately change the password for the default administrative account to a strong, unique password.
Use the Airship AI Acropolis administrative interface to change the default account password
Network Segmentation
allRestrict network access to Airship AI Acropolis instances using firewalls or network policies.
Configure firewall rules to limit access to trusted IP addresses only
🧯 If You Can't Patch
- Immediately change the default administrative account password to a strong, unique value
- Isolate affected systems from internet access and implement strict network segmentation
🔍 How to Verify
Check if Vulnerable:
Attempt to log in to the Airship AI Acropolis administrative interface using the default credentials (specific credentials not disclosed here).Check Version:
Check the Airship AI Acropolis administrative interface or documentation for version informationVerify Fix Applied:
Verify you cannot log in with default credentials and confirm the system is running version 10.2.35, 11.0.21, or 11.1.9.📡 Detection & Monitoring
Log Indicators:
- Multiple failed login attempts followed by successful login from unexpected IP addresses
- Administrative actions performed from unfamiliar locations or at unusual times
Network Indicators:
- Inbound connections to administrative ports from suspicious IP ranges
- Unusual outbound connections from the Airship AI system
SIEM Query:
source="airship_logs" AND (event_type="login_success" AND user="admin") OR (event_type="admin_action" AND src_ip NOT IN trusted_ips)