#VU54523 Input validation error in Kaseya VSA - CVE-2021-30116

Vulnerability identifier: #VU54523

Vulnerability risk: Critical

CVSSv4.0: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Red]

CVE-ID: CVE-2021-30116

CWE-ID: CWE-20

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Kaseya VSA
Server applications / Remote management servers, RDP, SSH

Vendor: Kaseya

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to unspecified error. A remote attacker can compromise the affected system.

Note, the vulnerability is being actively exploited in the wild by the REvil ransomware.

Mitigation
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

Kaseya VSA: All versions

---

External links
https://csirt.divd.nl/2021/07/04/Kaseya-Case-Update-2/
https://helpdesk.kaseya.com/hc/en-gb/articles/4403440684689

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.