Kaseya Virtual System Administrator Remote Privilege Escalation Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Kaseya Virtual System Administrator. Authentication is not required to exploit this vulnerability. The specific flaw exists within the forwarding service’s handing of the setAccount.aspx page, which does not properly enforce that users be authenticated before manipulating user accounts. Attackers can use this vulnerability to become “Master Admin” in the application and execute arbitrary code on all managed devices.