CVE-2017-18362: connectwise manageditsync

csirt@kutim:~/threat-intel/cve/CVE-2017-18362

CVSS 9.8 · Critical KEV · sudah dieksploitasi Dipakai ransomware EPSS 86,8%

Kerentanan Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') pada connectwise manageditsync. Skor CVSS 3.1 9.8 (Critical) menurut NVD. Masuk katalog KEV CISA pada 24 Mei 2022, artinya sudah terbukti dieksploitasi. Tercatat dipakai dalam kampanye ransomware.

Deskripsi (NVD)

ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database. In February 2019, attackers have actively exploited this in the wild to download and execute ransomware payloads on all endpoints managed by the VSA server. If the ManagedIT.asmx page is available via the Kaseya VSA web interface, anyone with access to the page is able to run arbitrary SQL queries, both read and write, without authentication.

Rincian

Terbit di NVD: 5 Februari 2019
Terakhir diubah: 13 Agustus 2026
Status NVD: Analyzed
CVSS 3.1: 9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
EPSS (30 hari): 86,8% peluang dieksploitasi; lebih tinggi dari 99,7% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama: Kaseya VSA SQL Injection Vulnerability
Masuk KEV: 24 Mei 2022
Tenggat CISA: 14 Juni 2022 (untuk instansi federal AS)
Ransomware: Tercatat dipakai dalam kampanye ransomware
Tindakan wajib: The impacted product is end-of-life and should be disconnected if still in use.

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
connectwise	manageditsync	Semua versi hingga 2017

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-18362 pemerintah AS
http://archive.today/rdkeQ advisory pihak ketiga
https://github.com/kbni/owlky exploit · advisory pihak ketiga
https://webcache.googleusercontent.com/search?q=cache:ZEo8ZRF_iEIJ:https://helpdesk.kaseya.com/hc/en-gb/articl... broken link · advisory pihak ketiga

Sumber: NVD · CVE.org · KEV CISA · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.