CVE-2019-14510 Hardcoded credentials in n/a
Default LAN Cache configuration creates a predictable local admin account, allowing attackers to use Pass-the-Hash to gain domain administrator privileges.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-14510?
CVE-2019-14510 is a medium-severity vulnerability in n/a, published on 11 Oct 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An issue was discovered in Kaseya VSA RMM through 9.5.0.22. When using the default configuration, the LAN Cache feature creates a local account FSAdminxxxxxxxxx (e.g., FSAdmin123456789) on the server that hosts the LAN Cache and all clients that are assigned to a LAN Cache. This account is placed into the local Administrators group of all clients assigned to the LAN Cache. When the assigned client is a Domain Controller, the FSAdminxxxxxxxxx account is created as a domain account and automatically added as a member of the domain BUILTIN\Administrators group. Using the well known Pass-the-Hash techniques, an attacker can use the same FSAdminxxxxxxxxx hash from any LAN Cache client and pass this to a Domain Controller, providing administrative rights to the attacker on any Domain Controller. (Local account Pass-the-Hash mitigations do not protect domain accounts.)
Which versions are affected by CVE-2019-14510?
It affects 1 product.
Products include Kaseya Vsa.
How do I fix CVE-2019-14510?
No fix has been published for CVE-2019-14510 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-14510 being exploited?
There is no known exploitation of CVE-2019-14510 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2021-30120 2FA bypass in Kaseya VSA <= v9.5.6
- CVE-2021-30117 Authenticated SQL injection in Kaseya VSA < v9.5.6
- CVE-2021-30118 Unauthenticated Remote Code Execution in Kaseya VSA < v9.5.5
- CVE-2021-30201 Unauthenticated XML External Entity vulnerability in Kaseya VSA < v9.5.6
- CVE-2021-30121 (Semi-)Authenticated local file inclusion in Kaseya VSA < v9.5.6
Sources
Also known as GHSA-g957-q4vg-hrv6.