CVE-2017-18362

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Aug 13, 2026

Description

ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database. In February 2019, attackers have actively exploited this in the wild to download and execute ransomware payloads on all endpoints managed by the VSA server. If the ManagedIT.asmx page is available via the Kaseya VSA web interface, anyone with access to the page is able to run arbitrary SQL queries, both read and write, without authentication.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Feb 5, 2019
Last modified
Aug 13, 2026
Added to CISA KEV
May 24, 2022
NVD status
Analyzed

Related CVEs from 2017

CVE-2017-183646.1phpFK lite has XSS via the faq.php, members.php, or search.php query string or the user.php user parameter.CVE-2017-183659.8The Management Console in GitHub Enterprise 2.8.x before 2.8.7 has a deserialization issue that allows unauthenticated remote attackers to eCVE-2017-183668.8Subrion CMS 4.1.5 has CSRF in blog/delete/.CVE-2017-183677.5libseccomp-golang 0.9.0 and earlier incorrectly generates BPFs that OR multiple arguments rather than ANDing them. A process running under aCVE-2017-183689.8The ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline has a command injection vulnerability inCVE-2017-183699.8The Billion 5200W-T 1.02b.rc5.dt49 router distributed by TrueOnline has a command injection vulnerability in the Remote System Log forwardinCVE-2017-183708.8The ZyXEL P660HN-T1A v2 TCLinux Fw #7.3.37.6 router distributed by TrueOnline has a command injection vulnerability in the Remote System LogCVE-2017-183719.8The ZyXEL P660HN-T1A v2 TCLinux Fw #7.3.37.6 router distributed by TrueOnline has three user accounts with default passwords, including two CVE-2017-183728.8The Billion 5200W-T TCLinux Fw $7.3.8.0 v008 130603 router distributed by TrueOnline has a command injection vulnerability in the Time SettiCVE-2017-183738.8The Billion 5200W-T TCLinux Fw $7.3.8.0 v008 130603 router distributed by TrueOnline has three user accounts with default passwords, includiCVE-2017-183748.8The ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline has two user accounts with default passwCVE-2017-183758.8Ampache 3.8.3 allows PHP Object Instantiation via democratic.ajax.php and democratic.class.php.