Critical severity · published Feb 17, 2020
CVE-2015-6922
Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.33, 8.x before 8.0.0.23, 9.0 before 9.0.0.19, and 9.1 before 9.1.0.9 does not properly require authentication, which…
9.8
CVSS
82.1%
EPSS
No
On KEV
Description
Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.33, 8.x before 8.0.0.23, 9.0 before 9.0.0.19, and 9.1 before 9.1.0.9 does not properly require authentication, which allows remote attackers to bypass authentication and (1) add an administrative account via crafted request to LocalAuth/setAccount.aspx or (2) write to and execute arbitrary files via a full pathname in the PathData parameter to ConfigTab/uploader.aspx.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)82.1% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VS
Virtual System Administrator · Kaseya
7.0.0.0 before 7.0.0.33; 8.0.0.0 before 8.0.0.23; 9.0.0.0 before 9.0.0.19; 9.1.0.0 before 9.1.0.9 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-6922
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-6922
Exploit
http://packetstormsecurity.com/files/133782/Kaseya-Virtual-System-Administrator-Code-Execution-Privilege-Escalation.html
Third Party Advisory
http://www.zerodayinitiative.com/advisories/ZDI-15-448
Third Party Advisory
http://www.zerodayinitiative.com/advisories/ZDI-15-449
Broken Link
https://helpdesk.kaseya.com/entries/96164487--Kaseya-Security-Advisory
Exploit
https://www.exploit-db.com/exploits/38351/
More from Virtual System Administrator
9.8
CVE-2018-20753
Kaseya VSA Remote Code Execution Vulnerability
8.8
CVE-2015-6589
Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.0.0.0 before 7.0.0.33, 8..0.0.0 before 8.0.0.23, 9.0.0.0 before 9.0.0.19, and 9.1.0.0 before…
7.5
CVE-2019-15506
An issue was discovered in Kaseya Virtual System Administrator (VSA) through 9.4.0.37
7.4
CVE-2017-12410
It is possible to exploit a Time of Check & Time of Use (TOCTOU) vulnerability by winning a race condition when Kaseya Virtual System Administrator agent 9.3.0.11 and earlier…
–
CVE-2015-2863
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 before 9.0.0.14, and 9.1 before 9.1.0.4 allows remote…