{"id":"CVE-2021-30116","kind":"vulnerability","aliases":["CVE-2021-30116"],"related":[],"title":"Kaseya Virtual System/Server Administrator (VSA): Kaseya Virtual System/Server Administrator (VSA) Information Disclosure Vulnerability","description":"Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021. By default Kaseya VSA on premise offers a download page where the clients for the installation can be downloaded. The default URL for this page is https://x.x.x.x/dl.asp When an attacker download a client for Windows and installs it, the file KaseyaD.ini is generated (C:\\Program Files (x86)\\Kaseya\\XXXXXXXXXX\\KaseyaD.ini) which contains an Agent_Guid and AgentPassword This Agent_Guid and AgentPassword can be used to log in on dl.asp (https://x.x.x.x/dl.asp?un=840997037507813&pw=113cc622839a4077a84837485ced6b93e440bf66d44057713cb2f95e503a06d9) This request authenticates the client and returns a sessionId cookie that can be used in subsequent attacks to bypass authentication. Security issues discovered --- * Unauthenticated download page leaks credentials * Credentials of agent software can be used to obtain a sessionId (cookie) that can be used for services not intended for use by agents * dl.asp accepts credentials via a GET request * Access to KaseyaD.ini gives an attacker access to sufficient information to penetrate the Kaseya installation and its clients. Impact --- Via the page /dl.asp enough information can be obtained to give an attacker a sessionId that can be used to execute further (semi-authenticated) attacks against the system.","summary":"Kaseya VSA, a remote monitoring and management server, leaks a session ID through an information disclosure flaw. An attacker can use that session ID to carry out further attacks on the VSA system.","severity":"critical","cvss":10.0,"epss":0.85735,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"Kaseya Virtual System/Server Administrator (VSA)","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","kaseya-vsa","msp","on-premise","ransomware","vendor"],"not_affected_if":["managed-hosting","no-vsa-deployment"],"how_to_check":null,"fix":"Apply the updates per Kaseya's vendor instructions; the specific fixed version is not stated in the sources.","status":"open","published_at":"2021-07-09T14:15:07+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:39:22+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-23T21:39:22Z","model":"claude-haiku-5-5","output":{"fix":"Apply the updates per Kaseya's vendor instructions; the specific fixed version is not stated in the sources.","reach":"network","impact":"high","summary":"Kaseya VSA, a remote monitoring and management server, leaks a session ID through an information disclosure flaw. An attacker can use that session ID to carry out further attacks on the VSA system.","category":"vendor","who_cares":["kaseya-vsa","msp","on-premise"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker takes a valid session and runs further attacks on VSA","analyst_note":"Find Kaseya's advisory for CVE-2021-30116 to get affected and fixed versions and a check method; the sources in the signal do not name them.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting","no-vsa-deployment"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000462,"input_tokens":2889,"output_tokens":346,"severity_before":"unknown"},"analyst_status":"queued","analyst_note":"Find Kaseya's advisory for CVE-2021-30116 to get affected and fixed versions and a check method; the sources in the signal do not name them.","search":"'-2021':15A,18A '-30116':16A,19A '/dl.asp':239C '113cc622839a4077a84837485ced6b93e440bf66d44057713cb2f95e503a06d9':157C '2021':82C '840997037507813':155C '9.5.7':71C 'accept':211C 'access':217C,223C 'administr':4A,9A 'administrator':23A 'agent':136C,141C,188C,209C 'agentpassword':139C,144C 'allow':72C 'attack':53B,63B,112C,174C,222C,248C,261C 'authent':160C,177C,260C 'bypass':176C 'c':126C 'carri':60B 'client':95C,115C,162C,234C 'contain':134C 'cooki':167C,197C 'credenti':73C,185C,186C,212C 'cve':14A,17A 'default':84C,103C 'disclosur':12A,50B,74C 'discov':180C 'dl.asp':152C,210C 'download':91C,101C,113C,182C 'enough':240C 'execut':256C 'exploit':25B,76C 'file':122C,128C 'flaw':51B 'generat':125C 'get':215C 'give':220C,246C 'guid':137C,142C 'id':46B,58B 'impact':235C 'inform':11A,49B,226C,241C 'instal':98C,119C,231C 'intend':205C 'issu':179C 'juli':81C 'kaseya':1A,6A,20A,27B,35B,68C,85C,130C,230C 'kaseya-vsa':26B 'kaseyad.ini':123C,132C,219C 'leak':43B,184C 'log':149C 'manag':41B 'monitor':39B 'msp':29B 'obtain':194C,244C 'offer':89C 'on-premis':30B 'page':92C,107C,183C,238C 'penetr':228C 'premis':32B,88C 'program':127C 'pw':156C 'ransomwar':33B 'remot':38B 'request':159C,216C 'return':164C 'secur':178C 'semi':259C 'semi-authent':258C 'server':42B 'servic':203C 'session':45B,57B 'sessionid':166C,196C,250C 'softwar':189C 'subsequ':173C 'suffici':225C 'system':67B,264C 'system/server':3A,8A,22A 'un':154C 'unauthent':181C 'url':104C 'use':55B,147C,171C,192C,201C,207C,254C 'vendor':34B 'via':213C,236C 'virtual':2A,7A,21A 'vsa':5A,10A,24A,28B,36B,66B,69C,86C 'vulner':13A 'wild':79C 'window':117C 'x.x.x.x/dl.asp':109C,153C 'x86':129C 'xxxxxxxxxx':131C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-07-09T14:15:07+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2021-11-17","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"cve@mitre.org","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-30116","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-30116","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T14:39:41+00:00","note":null},{"source":"epss","external_id":"CVE-2021-30116","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-30116","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-30116","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-30116","severity":null,"published_at":"2021-07-09T14:15:07+00:00","modified_at":"2026-08-14T05:16:54+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}