CVE-2017-18362 - CVE House
Back to Database
Status published Unknown CVE-2017-18362

ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable...

Vulnerability Description

ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database. In February 2019, attackers have actively exploited this in the wild to download and execute ransomware payloads on all endpoints managed by the VSA server. If the ManagedIT.asmx page is available via the Kaseya VSA web interface, anyone with access to the page is able to run arbitrary SQL queries, both read and write, without authentication.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-18362

Credits & Attribution

No credits recorded in the NVD database.

References

More from connectwise

View All →
CVE-2021-35066
An XXE vulnerability exists in ConnectWise Automate before 2021.0.6.132....
Critical 9.8
CVE-2021-32582
An issue was discovered in ConnectWise Automate before 2021.5. A...
High 7.5
CVE-2020-15838
The Agent Update System in ConnectWise Automate before 2020.8 allows...
High 8.8
CVE-2020-15027
ConnectWise Automate through 2020.x has insufficient validation on certain authentication...
Critical 9.8
CVE-2020-15008
A SQLi exists in the probe code of all Connectwise...
High 7.5

Affected Vendor

connectwise

View all reports →

Affected Software

manageditsync
Vulnerable Versions:
0

Timeline

Official Publish: February 5th, 2019
Last Modified: October 21st, 2025
Added to House: July 20th, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.