Description
Airship AI Acropolis allows unlimited MFA attempts for 15 minutes after a user has logged in with valid credentials. A remote attacker with valid credentials could brute-force the 6-digit MFA code. Fixed in 10.2.35, 11.0.21, and 11.1.9.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Airship AI | Acropolis | < 10.2.35, < 11.0.21, < 11.1.9 | 10.2.35 |
Advisories 1
- VA-25-265-01 Airship AI MFA bypass and default credentials vulnerabilities CISA ICS & IT advisories · Sep 22, 2025