CVE-2018-20753
Vulnerability from cvelistv5
Published
2019-02-05 05:00
Modified
2024-08-05 12:12
Severity ?
Summary
Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows unprivileged remote attackers to execute PowerShell payloads on all managed devices. In January 2018, attackers actively exploited this vulnerability in the wild.
References
cve@mitre.orghttps://blog.huntresslabs.com/deep-dive-kaseya-vsa-mining-payload-c0ac839a0e88Exploit, Third Party Advisory
cve@mitre.orghttps://helpdesk.kaseya.com/hc/en-gb/articles/360000333152Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://blog.huntresslabs.com/deep-dive-kaseya-vsa-mining-payload-c0ac839a0e88Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://helpdesk.kaseya.com/hc/en-gb/articles/360000333152Vendor Advisory
Impacted products
Vendor Product Version
CISA Known exploited vulnerability
Data from the Known Exploited Vulnerabilities Catalog

Date added: 2022-04-13

Due date: 2022-05-04

Required action: Apply updates per vendor instructions.

Used in ransomware: Known

Notes: https://nvd.nist.gov/vuln/detail/CVE-2018-20753

Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T12:12:28.564Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://blog.huntresslabs.com/deep-dive-kaseya-vsa-mining-payload-c0ac839a0e88"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://helpdesk.kaseya.com/hc/en-gb/articles/360000333152"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2019-02-04T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows unprivileged remote attackers to execute PowerShell payloads on all managed devices. In January 2018, attackers actively exploited this vulnerability in the wild."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-02-05T05:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://blog.huntresslabs.com/deep-dive-kaseya-vsa-mining-payload-c0ac839a0e88"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://helpdesk.kaseya.com/hc/en-gb/articles/360000333152"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-20753",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows unprivileged remote attackers to execute PowerShell payloads on all managed devices. In January 2018, attackers actively exploited this vulnerability in the wild."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://blog.huntresslabs.com/deep-dive-kaseya-vsa-mining-payload-c0ac839a0e88",
              "refsource": "MISC",
              "url": "https://blog.huntresslabs.com/deep-dive-kaseya-vsa-mining-payload-c0ac839a0e88"
            },
            {
              "name": "https://helpdesk.kaseya.com/hc/en-gb/articles/360000333152",
              "refsource": "MISC",
              "url": "https://helpdesk.kaseya.com/hc/en-gb/articles/360000333152"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-20753",
    "datePublished": "2019-02-05T05:00:00",
    "dateReserved": "2019-02-04T00:00:00",
    "dateUpdated": "2024-08-05T12:12:28.564Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "cisa_known_exploited": {
      "cveID": "CVE-2018-20753",
      "dateAdded": "2022-04-13",
      "dueDate": "2022-05-04",
      "knownRansomwareCampaignUse": "Known",
      "notes": "https://nvd.nist.gov/vuln/detail/CVE-2018-20753",
      "product": "Virtual System/Server Administrator (VSA)",
      "requiredAction": "Apply updates per vendor instructions.",
      "shortDescription": "Kaseya VSA RMM allows unprivileged remote attackers to execute PowerShell payloads on all managed devices.",
      "vendorProject": "Kaseya",
      "vulnerabilityName": "Kaseya VSA Remote Code Execution Vulnerability"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2018-20753\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2019-02-05T06:29:00.593\",\"lastModified\":\"2024-11-21T04:02:05.987\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows unprivileged remote attackers to execute PowerShell payloads on all managed devices. In January 2018, attackers actively exploited this vulnerability in the wild.\"},{\"lang\":\"es\",\"value\":\"Kaseya VSA RMM, en versiones anteriores a la R9.3 9.3.0.35, versiones R4 anteriores a la 9.4.0.36 y en las R9.5 anteriores a la 9.5.0.5, permite a los atacantes remotos sin privilegios ejecutar cargas \u00fatiles PowerShell en todos los dispositivos gestionados. En enero de 2018, los atacantes explotaban esta vulnerabilidad \\\"in the wild\\\" de manera activa.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:P/A:P\",\"baseScore\":7.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":10.0,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"cisaExploitAdd\":\"2022-04-13\",\"cisaActionDue\":\"2022-05-04\",\"cisaRequiredAction\":\"Apply updates per vendor instructions.\",\"cisaVulnerabilityName\":\"Kaseya VSA Remote Code Execution Vulnerability\",\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:kaseya:virtual_system_administrator:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"9.3\",\"versionEndExcluding\":\"9.3.0.35\",\"matchCriteriaId\":\"22355062-DF3F-4ADD-8441-2996D5E46686\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:kaseya:virtual_system_administrator:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"9.4\",\"versionEndExcluding\":\"9.4.0.36\",\"matchCriteriaId\":\"60635910-DD05-4230-9F28-2B525804F5E6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:kaseya:virtual_system_administrator:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"9.5\",\"versionEndExcluding\":\"9.5.0.5\",\"matchCriteriaId\":\"CF8B7BE5-6384-450B-BE61-F5AA4FA552D9\"}]}]}],\"references\":[{\"url\":\"https://blog.huntresslabs.com/deep-dive-kaseya-vsa-mining-payload-c0ac839a0e88\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://helpdesk.kaseya.com/hc/en-gb/articles/360000333152\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://blog.huntresslabs.com/deep-dive-kaseya-vsa-mining-payload-c0ac839a0e88\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]},{\"url\":\"https://helpdesk.kaseya.com/hc/en-gb/articles/360000333152\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.