Kaseya VSA Credential Disclosure and Authentication Bypass Vulnerability (CVE-2021-30116) Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTKaseya VSA on-premise installations prior to version 9.5.7
Attackers can extract agent credentials to obtain a valid session ID, bypassing authentication to gain unauthorized control over the system
Immediately upgrade Kaseya VSA to version 9.5.7 or higher, and restrict external access to the dl.asp page
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Immediately upgrade your Kaseya VSA instances to version 9.5.7 or later. Below are administrative commands to stop services and back up the environment before applying the patch.
# Stop IIS and Kaseya Edge Services to prevent active connections during patch
iisreset /stop
Stop-Service -Name 'KaseyaEdgeServices' -Force
# Backup the Kaseya installation directory
Compress-Archive -Path 'C:\Kaseya' -DestinationPath 'C:\Kaseya_Backup_Prior_To_Patch.zip'2. Temporary Workaround & Hardening Configuration
If patching cannot be applied immediately, restrict access to the dl.asp page using IIS URL Rewrite rules to allow only trusted IP addresses.
<!-- IIS URL Rewrite Rule to block external access to dl.asp -->
<configuration>
<system.webServer>
<rewrite>
<rules>
<rule name='Restrict dl.asp' stopProcessing='true'>
<match url='^dl\.asp$' />
<conditions>
<!-- Replace with your trusted internal admin IP range -->
<add input='{REMOTE_ADDR}' pattern='^10\.0\.' negate='true' />
</conditions>
<action type='CustomResponse' statusCode='403' statusReason='Forbidden' />
</rule>
</rules>
</rewrite>
</system.webServer>
</configuration>3. Log Audit & IoC Verification Commands
Run the following PowerShell script to inspect IIS log files for suspicious GET requests targeting dl.asp with credential parameters.
# Scan IIS logs for potential exploitation attempts of CVE-2021-30116
$LogFiles = Get-ChildItem -Path 'C:\inetpub\logs\LogFiles\W3SVC1\*.log'
foreach ($Log in $LogFiles) {
Select-String -Path $Log.FullName -Pattern 'dl\.asp\?un=' | ForEach-Object {
Write-Host '[!] Warning: Potential Exploit Attempt Found in' $Log.Name -ForegroundColor Red
Write-Host $_.Line
}
}Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2021-30116) is a critical credential disclosure and authentication bypass flaw in the default download page (dl.asp) and agent installation process of Kaseya VSA on-premise servers. By default, Kaseya VSA hosts a public client download page. During the installation of the Windows client, a configuration file named KaseyaD.ini is generated, which contains sensitive agent credentials (Agent_Guid and AgentPassword) in plaintext or weakly secured formats (CWE-522).
2. Exploitation Mechanics & Attack Scenario
An attacker can exploit this vulnerability through the following steps:
- Information Gathering: The attacker accesses the publicly exposed download page (
https://<Target_IP>/dl.asp) to download and run the Windows client installer. - Credential Extraction: The installer generates
KaseyaD.inilocally underC:\Program Files (x86)\Kaseya\...\, from which the attacker extracts theAgent_GuidandAgentPassword. - Authentication Bypass: The attacker sends a GET request to
dl.asppassing the extracted credentials as parameters (e.g.,dl.asp?un=<Agent_Guid>&pw=<AgentPassword>). The server authenticates the request and returns a validsessionIdcookie. - Session Hijacking: The attacker uses this
sessionIdto bypass authentication and perform administrative actions or execute arbitrary commands on the VSA server.
3. Infrastructure & Business Impact
This vulnerability was actively exploited in the wild in July 2021 by the REvil ransomware group to launch a massive supply chain attack targeting Managed Service Providers (MSPs) and their downstream customers. Successful exploitation allows attackers to hijack the VSA server, enabling them to deploy ransomware or malicious payloads to all connected endpoints, leading to catastrophic business disruption and financial loss.
Official Vendor Advisories & References
Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021. By default Kaseya VSA on premise offers a download page where the clients for the installation can be downloaded. The default URL for this page is https://x.x.x.x/dl.asp When an attacker download a client for Windows and installs it, the file KaseyaD.ini is generated (C:\Program Files (x86)\Kaseya\XXXXXXXXXX\KaseyaD.ini) which contains an Agent_Guid and AgentPassword This Agent_Guid and AgentPassword can be used to log in on dl.asp (https://x.x.x.x/dl.asp?un=840997037507813&pw=113cc622839a4077a84837485ced6b93e440bf66d44057713cb2f95e503a06d9) This request authenticates the client and returns a sessionId cookie that can be used in subsequent attacks to bypass authentication. Security issues discovered --- * Unauthenticated download page leaks credentials * Credentials of agent software can be used to obtain a sessionId (cookie) that can be used for services not intended for use by agents * dl.asp accepts credentials via a GET request * Access to KaseyaD.ini gives an attacker access to sufficient information to penetrate the Kaseya installation and its clients. Impact --- Via the page /dl.asp enough information can be obtained to give an attacker a sessionId that can be used to execute further (semi-authenticated) attacks against the system.
Frequently Asked SecOps Questions (CVE-2021-30116)
FAQQ1. How critical is CVE-2021-30116 and is it actively exploited in the wild?
CVE-2021-30116 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 85.7%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2021-30116?
Primary impacted vendors include kaseya across vsa. Scope summary: All Kaseya VSA on-premise versions prior to 9.5.7 (Known Exploited Vulnerability in CISA KEV)
Q3. What temporary mitigations or workarounds exist for CVE-2021-30116 before patching?
[Mitigation] Immediately upgrade Kaseya VSA to version 9.5.7 or higher, and restrict external access to the dl.asp page Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2021-30116
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (kaseya)
View Category →Ahsay AhsayCBS Replication Receiver Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-105134)
[Affected Scope] AhsayCBS versions up to 9.15.2.69 and 10.3.4.44, specifically the Replication Receiver component
Adobe Commerce (Magento) Server-Side Template Injection (SSTI) Remote Code Execution (CVE-2026-75650)
[Affected Scope] All unpatched versions of Adobe Commerce and Magento Open Source.
Metabase /reset_password Endpoint Unauthenticated SQL Injection and Admin Takeover (CVE-2026-72898)
[Affected Scope] Unpatched active instances of Metabase Open Source and Enterprise editions
WSO2 JWT Authentication Bypass and Account Takeover (CVE-2026-5430)
[Affected Scope] WSO2 Identity Server, API Manager, and products utilizing WSO2 JWT authentication modules.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.