# CVE-2018-20753

Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows unprivileged remote attackers to execute PowerShell payloads on all managed devices. In January 2018, attackers actively exploited this vulnerability in the wild.

- Page: https://www.vulneraibility.com/cve/CVE-2018-20753
- CVSS: 9.8
- Known exploited: yes, in CISA KEV since 2022-04-13; CISA due date 2022-05-04; known ransomware use
- EPSS: 29.55% (percentile 98.2)
- CISA SSVC: exploitation active, automatable yes, technical impact total (assessed 2022-04-14)
- Published: 2019-02-05

## Affected

- kaseya:virtual_system_administrator

## References

- [other] https://blog.huntresslabs.com/deep-dive-kaseya-vsa-mining-payload-c0ac839a0e88
- [other] https://helpdesk.kaseya.com/hc/en-gb/articles/360000333152
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-20753

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.