by Kastro
Paper/Archive/CVE-2018-20753

CVE-2018-20753

Kaseya Virtual System/Server Administrator (VSA) — Kaseya VSA Remote Code Execution Vulnerability

KEV · due 4 Mayransomware useEPSS 30%public exploitSSVC actCVSS 9.8
critical.is priorityof 100
99
CVSS 9.8 (ADP)9.8 / 10 × 3029.4In CISA KEV+3030.0EPSS percentile 98.2.982 × 2019.6Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows unprivileged remote attackers to execute PowerShell payloads on all managed devices. In January 2018, attackers actively exploited this vulnerability in the wild.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refblog.huntresslabs.com/deep-dive-kaseya-vsa-mining-payload-c0ac839a0e88refhelpdesk.kaseya.com/hc/en-gb/articles/360000333152refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-20753kevcisa.gov/known-exploited-vulnerabilities-catalog