Skip to content
CVE PROGRAM SOURCE RECORD7.7 High

CVE-2025-35041

Airship AI Acropolis MFA insufficient rate limiting

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
cisa-cg

Description

Airship AI Acropolis allows unlimited MFA attempts for 15 minutes after a user has logged in with valid credentials. A remote attacker with valid credentials could brute-force the 6-digit MFA code. Fixed in 10.2.35, 11.0.21, and 11.1.9.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Airship AI Acropolis

Default version status: unknown

  • 0 to < 10.2.35affected
  • 0 to < 11.0.21affected
  • 0 to < 11.1.9affected
  • 10.2.35unaffected
  • 11.0.21unaffected
  • 11.1.9unaffected

References