Exploited· due 2021-11-1710.0criticalCriticalused in ransomware

CVE-2021-30116

Kaseya Vsa Agent

Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021. By default Kaseya VSA on premise offers a download page where the clients for the installation can be downloaded. The default URL for this page is https://x.x.x.x/dl.asp When an attacker download a client for Windows and installs it, the file KaseyaD.ini is generated (C:\Program Files (x86)\Kaseya\XXXXXXXXXX\KaseyaD.ini) which contains an Agent_Guid and AgentPassword This Agent_Guid and AgentPassword can be used to log in on dl.asp (https://x.x.x.x/dl.asp?un=840997037507813&pw=113cc622839a4077a84837485ced6b93e440bf66d44057713cb2f95e503a06d9) This request authenticates the client and returns a sessionId cookie that can be used in subsequent attacks to bypass authentication. Security issues discovered --- * Unauthenticated download page leaks credentials * Credentials of agent software can be used to obtain a sessionId (cookie) that can be used for services not intended for use by agents * dl.asp accepts credentials via a GET request * Access to KaseyaD.ini gives an attacker access to sufficient information to penetrate the Kaseya installation and its clients. Impact --- Via the page /dl.asp enough information can be obtained to give an attacker a sessionId that can be used to execute further (semi-authenticated) attacks against the system.

Exploitation status

CISA has confirmed this is being exploited in the wild. That is an observation of real attacks, not a prediction.
It is known to have been used in ransomware campaigns.
US federal civilian agencies are required to remediate it by 2021-11-17. That deadline does not bind private companies, but it is a reasonable benchmark for how urgently CISA views it.
A vendor advisory or patch reference has been published.

Required action

Apply updates per vendor instructions.

CISA’s wording, unedited.

What the metrics mean

It is reachable over a network, without needing local access.
For an attacker who can reach it, no special conditions are needed to exploit it.
To exploit it, no account is needed.
Beyond that, no action by a user is required.

Scoring

CVSS: 10.0 (v3.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness: CWE-522
Assigned by: cve@mitre.org

Dates

Published: 2021-07-09
Last modified: 2026-08-14
Added to KEV: 2021-11-03
Remediation due: 2021-11-17
Sources: CISA KEV, NVD

Affected products

Kaseya Vsa Agent- 9.5.0.24
Kaseya Vsa Server- 9.5.7a

As listed in the NVD configuration data. Not a statement about your estate.