CVE-2015-6922: Critical severity kaseya vsa agent vulnerability
Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.33, 8.x before 8.0.0.23, 9.0 before 9.0.0.19, and 9.1 before 9.1.0.9 does not properly require authentication, which allows remote attackers to bypass authentication and (1) add an administrative account via crafted request to LocalAuth/setAccount.aspx or (2) write to and execute arbitrary files via a full pathname in the PathData parameter to ConfigTab/uploader.aspx.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-6922?
CVE-2015-6922 has a high severity rating due to its potential for unauthorized access and privilege escalation.
How do I fix CVE-2015-6922?
To fix CVE-2015-6922, upgrade Kaseya VSA to versions 7.0.0.33, 8.0.0.23, 9.0.0.19, or 9.1.0.9 or later.
What systems are affected by CVE-2015-6922?
CVE-2015-6922 affects Kaseya Virtual System Administrator versions prior to 7.0.0.33, 8.0.0.23, 9.0.0.19, and 9.1.0.9.
What type of attack can CVE-2015-6922 facilitate?
CVE-2015-6922 can facilitate remote attackers bypassing authentication to add unauthorized administrative accounts.
Is there a known exploit for CVE-2015-6922?
Yes, there are known exploits for CVE-2015-6922 that take advantage of the authentication bypass vulnerability.