CVE-2021-30120 in the critical feed json
2FA bypass in Kaseya VSA <= v9.5.6
published 2021-07-09 5 y ago modified 2026-08-14 2 mo ago also EUVD-2021-17060
- cvss
- 9.9
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 5.7%
- EPSS 5.7% chance of exploitation in 30 days, percentile 93%
- public exploits
- 0
- none known
Summary
Kaseya VSA before 9.5.7 allows attackers to bypass the 2FA requirement. The need to use 2FA for authentication in enforce client-side instead of server-side and can be bypassed using a local proxy. Thus rendering 2FA useless. Detailed description --- During the login process, after the user authenticates with username and password, the server sends a response to the client with the booleans MFARequired and MFAEnroled. If the attacker has obtained a password of a user and used an intercepting proxy (e.g. Burp Suite) to change the value of MFARequered from True to False, there is no prompt for the second factor, but the user is still logged in.
Patch / fix
Timeline
- CISA SSVC: exploitation active
- Published
CISA SSVC
- Exploitation
- Active, exploited in the wild
- Automatable
- yes
- Technical impact
- total
- Assessed
- 5 y ago
Exploit prediction
5.70% chance of exploitation in the next 30 days, higher than 93% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.9 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:P/A:N |
Classification
- Weakness
-
- CWE-669 Incorrect Resource Transfer Between Spheres
References
-
csirt.divd.nl
/2021/07/07/Kaseya-Limited-Disclosure/
patch, third-party-advisory
-
csrit.divd.nl
/DIVD-2021-00011
permissions-required, third-party-advisory
-
csrit.divd.nl
/CVE-2021-30120
permissions-required, third-party-advisory
Sources
- CVE List CVE-2021-30120
- NVD CVE-2021-30120
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.