CVE-2019-14510
First published: Fri Oct 11 2019(Updated: )
An issue was discovered in Kaseya VSA RMM through 9.5.0.22. When using the default configuration, the LAN Cache feature creates a local account FSAdminxxxxxxxxx (e.g., FSAdmin123456789) on the server that hosts the LAN Cache and all clients that are assigned to a LAN Cache. This account is placed into the local Administrators group of all clients assigned to the LAN Cache. When the assigned client is a Domain Controller, the FSAdminxxxxxxxxx account is created as a domain account and automatically added as a member of the domain BUILTIN\Administrators group. Using the well known Pass-the-Hash techniques, an attacker can use the same FSAdminxxxxxxxxx hash from any LAN Cache client and pass this to a Domain Controller, providing administrative rights to the attacker on any Domain Controller. (Local account Pass-the-Hash mitigations do not protect domain accounts.)
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Kaseya VSA Agent | <=9.5.0.22 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2019-14510?
CVE-2019-14510 is classified as a high severity vulnerability due to the creation of accounts with potential unauthorized access.
How do I fix CVE-2019-14510?
To mitigate CVE-2019-14510, it is recommended to disable the LAN Cache feature or update to a fixed version of Kaseya VSA beyond 9.5.0.22.
What are the potential impacts of CVE-2019-14510?
The potential impacts of CVE-2019-14510 include unauthorized account creation and possible interaction with sensitive system resources.
Which versions of Kaseya VSA are affected by CVE-2019-14510?
CVE-2019-14510 affects Kaseya VSA versions up to and including 9.5.0.22.
How does CVE-2019-14510 compromise security?
CVE-2019-14510 compromises security by allowing the default configuration to create local accounts that could be exploited for unauthorized access.
- agent/weakness
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/last-modified-date
- agent/references
- agent/severity
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/kaseya
- canonical/kaseya vsa agent
- version/kaseya vsa agent/9.5.0.22