AEGLIX vulnerability intelligence
CVE-2017-18362
CRITICAL · CVSS 9.8 · Analyzed
Published: 2019-02-05 · Updated: 2026-08-13 · Source: NVD
Vulnerability overview
ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database. In February 2019, attackers have actively exploited this in the wild to download and execute ransomware payloads on all endpoints managed by the VSA server. If the ManagedIT.asmx page is available via the Kaseya VSA web interface, anyone with access to the page is able to run arbitrary SQL queries, both read and write, without authentication.
Severity and scoring
- CVSS score
- 9.8 · CRITICAL
- CVSS version
- 3.1
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-89
CVSS measures technical severity; it does not establish whether this vulnerability is being exploited in your environment.
Known exploitation and remediation
Listed in CISA’s Known Exploited Vulnerabilities catalog.
- Affected product
- Kaseya · Virtual System/Server Administrator (VSA)
- Added to catalog
- 2022-05-24
- Required action
- The impacted product is end-of-life and should be disconnected if still in use.
- CISA remediation due date
- 2022-06-14
CISA deadlines apply to the organizations covered by its directives. Confirm your own remediation requirements.
Verify affected versions and patch availability in the vendor advisory before making changes.
Affected products and versions
cpe:2.3:a:connectwise:manageditsync:*:*:*:*:*:kaseya_vsa:*:*
Through (inclusive): 2017
These are NVD CPE applicability entries. Some products depend on configuration conditions; consult the official record to confirm applicability.
Advisories and references
- http://archive.today/rdkeQ
Third Party Advisory
- https://github.com/kbni/owlky
Exploit · Third Party Advisory
- https://webcache.googleusercontent.com/search?q=cache:ZEo8ZRF_iEIJ:https://helpdesk.kaseya.com/hc/en-gb/articles/360022495572-Connectwise-API-Vulnerability+
Broken Link · Third Party Advisory
- http://archive.today/rdkeQ
Third Party Advisory
- https://github.com/kbni/owlky
Exploit · Third Party Advisory
- https://webcache.googleusercontent.com/search?q=cache:ZEo8ZRF_iEIJ:https://helpdesk.kaseya.com/hc/en-gb/articles/360022495572-Connectwise-API-Vulnerability+
Broken Link · Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-18362
US Government Resource