critical9.8Known exploited
CVE-2018-20753
Kaseya VSA Remote Code Execution Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-04-13. Federal due date: 2022-05-04.
Apply updates per vendor instructions.
Impact
Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows unprivileged remote attackers to execute PowerShell payloads on all managed devices. In January 2018, attackers actively exploited this vulnerability in the wild.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Kaseya | Virtual System Administrator | from 9.3 before 9.3.0.35 from 9.4 before 9.4.0.36 from 9.5 before 9.5.0.5 |
References
- NVD record
- CVE.org record
- CISA KEV catalog
- https://blog.huntresslabs.com/deep-dive-kaseya-vsa-mining-payload-c0ac839a0e88
- https://helpdesk.kaseya.com/hc/en-gb/articles/360000333152
- https://blog.huntresslabs.com/deep-dive-kaseya-vsa-mining-payload-c0ac839a0e88
- https://helpdesk.kaseya.com/hc/en-gb/articles/360000333152
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-20753