CVE-2018-20753criticalunder attackransomware

CVE-2018-20753

Published · Updated

Follow this CVE+ Monitor Virtual System/Server Administrator

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

63Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 9.8epss 30%
from disclosure to weapon
Published on NVDFeb 5
CISA KEV+1163d
Action required by CISAfederal deadline: 2022-05-04

Apply updates per vendor instructions.

In short

Kaseya VSA, a remote management tool, allowed attackers to run malicious PowerShell commands on all computers managed by the system without needing special permissions. This was actively exploited by criminals in January 2018.

Technical detail

Unauthenticated remote attackers could execute arbitrary PowerShell payloads on all managed endpoints through Kaseya VSA versions prior to R9.3 9.3.0.35, R9.4 9.4.0.36, and R9.5 9.5.0.5. The vulnerability required no authentication or user interaction and had widespread impact across managed device networks.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows unprivileged remote attackers to execute PowerShell payloads on all managed devices. In January 2018, attackers actively exploited this vulnerability in the wild.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a