CVE-2018-20753

Kaseya VSA Remote Code Execution

9.8 CRITICALActively exploited (CISA KEV)Used in ransomwarePublic exploitEPSS 29.6%

Published5 Feb 2019
Added to CISA KEV13 Apr 2022
Remediation due4 May 2022

Description

Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows unprivileged remote attackers to execute PowerShell payloads on all managed devices. In January 2018, attackers actively exploited this vulnerability in the wild.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Kaseya Virtual System Administrator≥ 9.3 < 9.3.0.35 · ≥ 9.4 < 9.4.0.36 · ≥ 9.5 < 9.5.0.5

Remediation

Fixed in

Kaseya Virtual System Administrator≥ 9.3.0.35

Patch & vendor advisories

https://helpdesk.kaseya.com/hc/en-gb/articles/360000333152

References

https://blog.huntresslabs.com/deep-dive-kaseya-vsa-mining-payload-c0ac839a0e88ExploitThird Party Advisory
https://helpdesk.kaseya.com/hc/en-gb/articles/360000333152Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-20753US Government Resource

Frequently asked

Is CVE-2018-20753 being actively exploited?

Yes. CVE-2018-20753 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 13 Apr 2022. It has been used in ransomware campaigns.

How severe is CVE-2018-20753?

CVE-2018-20753 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 29.6% probability of exploitation.

Which products are affected by CVE-2018-20753?

Affected products include Kaseya Virtual System Administrator.

How do I fix CVE-2018-20753?

Upgrade affected software to a fixed version, for example Kaseya Virtual System Administrator 9.3.0.35 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2018-20753 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.