PT-2019-13724 · Kaseya · Kaseya Vsa Rmm

Published 2019-10-11 · Updated 2021-07-21 · CVE-2019-14510

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Kaseya VSA RMM versions through 9.5.0.22

Description An issue in the default configuration of the LAN Cache feature creates a local account FSAdminxxxxxxxxx on the server and clients assigned to the LAN Cache, adding it to the local Administrators group. On Domain Controllers, this account is created as a domain account and added to the domain BUILTINAdministrators group. An attacker can use Pass-the-Hash techniques with the FSAdminxxxxxxxxx hash from any LAN Cache client to gain administrative rights on any Domain Controller.

Recommendations For versions through 9.5.0.22, consider disabling the LAN Cache feature to prevent the creation of the FSAdminxxxxxxxxx account until a patch is available. Restrict access to the local Administrators group and the domain BUILTINAdministrators group to minimize the risk of exploitation. Avoid using the default configuration of the LAN Cache feature until the issue is resolved.

Exploit

Fix

Incorrect Default Permissions

Improper Authentication

Weakness Enumeration

CWE-276

CWE-287

Related Identifiers

CVE-2019-14510

Affected Products

Kaseya Vsa Rmm

References · 7

• 🔥 https://lockstepgroup.com/blog/abusing-the-kaseya-lan-cache-fsadmin · Exploit
• 🔥 https://lockstepgroup.com/blog/cve-2019-14510-abusing-the-kaseya-lan-cache-fsadmin-red-team-edition · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-14510 · Security Note
• https://osv.dev/vulnerability/CVE-2019-14510 · Vendor Advisory
• http://community.kaseya.com/xsp/f/355.aspx · Note
• http://community.kaseya.com/xsp/f/355/t/24675.aspx · Note
• https://kaseya.com/products/vsa · Note