CVE-2018-20753
Last modified
CVE-2018-20753 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows unprivileged remote attackers to execute PowerShell payloads on all managed devices. In January 2018, attackers actively exploited this vulnerability in the wild.. CISA has confirmed active exploitation in the wild. EPSS estimates a 29.55% chance of exploitation in the next 30 days.
Description
Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows unprivileged remote attackers to execute PowerShell payloads on all managed devices. In January 2018, attackers actively exploited this vulnerability in the wild.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitation Status
This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by .
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Kaseya | Virtual System Administrator | >= 9.3, < 9.3.0.35 |
| Kaseya | Virtual System Administrator | >= 9.4, < 9.4.0.36 |
| Kaseya | Virtual System Administrator | >= 9.5, < 9.5.0.5 |
References
- https://blog.huntresslabs.com/deep-dive-kaseya-vsa-mining-payload-c0ac839a0e88Exploit, Third Party Advisory
- https://helpdesk.kaseya.com/hc/en-gb/articles/360000333152Vendor Advisory
- https://blog.huntresslabs.com/deep-dive-kaseya-vsa-mining-payload-c0ac839a0e88Exploit, Third Party Advisory
- https://helpdesk.kaseya.com/hc/en-gb/articles/360000333152Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-20753US Government Resource
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2018-20753?
How severe is CVE-2018-20753?
How do I fix CVE-2018-20753?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2018
- CVE-2018-20748LibVNC before 0.9.12 contains multiple heap out-of-bounds wr…9.8
- CVE-2018-20749LibVNC before 0.9.12 contains a heap out-of-bounds write vul…9.8
- CVE-2018-2075Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
- CVE-2018-20750LibVNC through 0.9.12 contains a heap out-of-bounds write vu…9.8
- CVE-2018-20751An issue was discovered in crop_page in PoDoFo 0.9.6. For a …
- CVE-2018-20752An issue was discovered in Recon-ng before 4.9.5. Lack of va…
- CVE-2018-20755MODX Revolution through v2.7.0-pl allows XSS via the User Ph…
- CVE-2018-20756MODX Revolution through v2.7.0-pl allows XSS via a document …
- CVE-2018-20757MODX Revolution through v2.7.0-pl allows XSS via an extended…
- CVE-2018-20758MODX Revolution through v2.7.0-pl allows XSS via User Settin…5.4
- CVE-2018-2076Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
- CVE-2018-20760In GPAC 0.7.1 and earlier, gf_text_get_utf8_line in media_to…
Are you affected by CVE-2018-20753?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST