Kaseya · Virtual System/Server Administrator (VSA)

CVE-2018-20753

Kaseya VSA Remote Code Execution Vulnerability

Exploited in attacks Used by ransomware Critical 9.8 Attack chance: 30%

What it is

Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows unprivileged remote attackers to execute PowerShell payloads on all managed devices. In January 2018, attackers actively exploited this vulnerability in the wild.

CISA: Kaseya VSA RMM allows unprivileged remote attackers to execute PowerShell payloads on all managed devices.

What to do

Apply updates per vendor instructions.

Deadline for US federal agencies: May 4, 2022

Added to the CISA list: April 13, 2022
Published: February 5, 2019
Severity: Critical 9.8 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 30% in the top 1.8% of all known vulnerabilities
More details: NVD · CVE.org · CISA

All references (2)

More exploited flaws from Kaseya

Added	Vulnerability	Product	Severity	Attack chance
May 24, 2022	VSA SQL InjectionCVE-2017-18362used by ransomware	Virtual System/Server Administrator (VSA)	Critical 9.8	87%
Nov 3, 2021	Information DisclosureCVE-2021-30116used by ransomware	Virtual System/Server Administrator (VSA)	Critical 10.0	86%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.