CVE-2018-20753 Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows unprivileged remote attackers to execute PowerShell payloads on all managed devices. In January 2018, attacker...
CriticalCVSS 9.8
EPSS 29.6%
CISA KEV
added 2022-04-13 · due 2022-05-04
Ransomware
Exploited in the wild
- Published
- Updated
- Exploit status
- Exploited in the wild (confirmed)
Description
Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows unprivileged remote attackers to execute PowerShell payloads on all managed devices. In January 2018, attackers actively exploited this vulnerability in the wild.
CISA Known Exploited Vulnerability
- Date added
- 2022-04-13
- Due date (FCEB)
- 2022-05-04
- Ransomware use
- Known
Required action
Apply updates per vendor instructions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| kaseya virtual system administrator | >= 9.3, < 9.3.0.35 | 9.3.0.35 |
| kaseya virtual system administrator | >= 9.4, < 9.4.0.36 | 9.4.0.36 |
| kaseya virtual system administrator | >= 9.5, < 9.5.0.5 | 9.5.0.5 |
References
- blog.huntresslabs.com exploit third-party-advisory
- helpdesk.kaseya.com vendor-advisory
- www.cisa.gov government-resource us-government-resource