CVE-2018-20753KEV · OVERDUE

Kaseya VSA Remote Code Execution Vulnerability

Critical · published February 5, 2019

Patch now

Confirmed exploited, and the score agrees

CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 98.2th percentile for exploit probability.

1633
days past CISA
deadline
CVSS v3.1
9.8
EPSS
30%
Percentile
98.2
In the wild
Confirmed
What it is

🚨 Kaseya VSA RMM versions before R9.5.0.5 are a playground for unprivileged attackers, allowing them to execute PowerShell commands remotely on all managed devices—yikes! 🔥 This vulnerability is like leaving the front door of your IT infrastructure wide open, inviting intruders to stroll in and start messing with your systems without needing a key. Just a few keystrokes, and poof! Your devices are under their control! With this critical vulnerability, an attacker could unleash PowerShell payloads, executing commands as if they were the administrator. This means they could potentially steal sensitive data, deploy malware, or disrupt operations—an absolutely devastating scenario for any organization. You don't want to be on the receiving end of a cyber disaster!

Put simply

This vulnerability is like leaving the front door of your IT infrastructure wide open, inviting intruders to stroll in and start messing with your systems without needing a key. Just a few keystrokes, and poof! Your devices are under their control! CVE-2018-20753 allows unprivileged remote attackers to execute arbitrary PowerShell scripts on all managed devices through flaws in Kaseya VSA RMM before versions 9.3.0.35, 9.4.0.36, and 9.5.0.5. Attackers can exploit this vulnerability to gain unauthorized access and control over systems.

What to do

With this critical vulnerability, an attacker could unleash PowerShell payloads, executing commands as if they were the administrator. This means they could potentially steal sensitive data, deploy malware, or disrupt operations—an absolutely devastating scenario for any organization. You don't want to be on the receiving end of a cyber disaster! Update your Kaseya VSA RMM to the latest versions: 9.3.0.35, 9.4.0.36, or 9.5.0.5 immediately. Regularly audit your systems to ensure no lingering vulnerabilities exist, and implement strict access controls to minimize risks. 🛡️ You can tackle this! Follow these steps, and you’ll be securing your environment in no time. You've got this! 💪😊

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.29551 · 98.2th percentile
Published
2019-02-05T11:29Z
KEV added
2022-04-13 · due 2022-05-04
Affected products (3)
ProductVersionsFixed in
kaseya/virtual_system_administrator≥ 9.3, < 9.3.0.359.3.0.35
kaseya/virtual_system_administrator≥ 9.4, < 9.4.0.369.4.0.36
kaseya/virtual_system_administrator≥ 9.5, < 9.5.0.59.5.0.5
References (5)
EPSS history
Timeline
  • 13 APR 00:00Z
    Added to CISA KEV — remediate by May 4
    kev
  • 05 FEB 05:00Z
    Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows unprivileged remote attackers to execute PowerShell payloads on all…
    cvelistv5