PatchTheCVECVE-2021-30201: The API /vsaWS/KaseyaWS.asmx can be used to submit XML to the system
CVE-2021-30201 is a high-severity flaw (CVSS 7.5) affecting vsa. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The API /vsaWS/KaseyaWS.asmx can be used to submit XML to the system. When this XML is processed (external) entities are insecurely processed and fetched by the system and returned to the attacker. Detailed description Given the following request: ``` POST /vsaWS/KaseyaWS.asmx HTTP/1.1 Content-Type: text/xml;charset=UTF-8 Host: 192.168.1.194:18081 Content-Length: 406 <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmln
Why this priority
- High severity
- EPSS top 2%: very likely to be exploited
- Public exploit reference
- Remotely exploitable, no login, no user action
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.5 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 26.1% (top 2%) |
| CISA exploited list | No |
| Weakness | CWE-611 |
| Published | 2021-07-09 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2021-30201?
vsa: upgrade to 9.5.6. Exact commands for each OS are on this page.
Is CVE-2021-30201 being exploited?
CVE-2021-30201 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2021-30201 affect?
CVE-2021-30201 affects vsa. Severity is high (CVSS 7.5). The API /vsaWS/KaseyaWS.asmx can be used to submit XML to the system. When this XML is processed (external) entities are insecurely processed and fetched by the system and returned to the attacker. Detailed description Given the following r
How urgent is CVE-2021-30201?
Priority 66/100. High severity; EPSS top 2%: very likely to be exploited; Public exploit reference; Remotely exploitable, no login, no user action; On your watchlist
Related CVEs
- CVE-2021-30120 CRITICAL 9.9 UPGRADE Kaseya VSA before 9.5.7 allows attackers to bypass the 2FA requirement
- CVE-2021-30119 MEDIUM 5.4 UPGRADE Authenticated reflective XSS in HelpDeskTab/rcResults.asp The parameter result of /HelpDeskTab/rcResults.asp i
- CVE-2021-30121 MEDIUM 6.5 UPGRADE Semi-authenticated local file inclusion The contents of arbitrary files can be returned by the webserver Examp
- CVE-2021-30118 CRITICAL 9.8 UPGRADE An attacker can upload files with the privilege of the Web Server process for Kaseya VSA Unified Remote Monito
- CVE-2021-30117 CRITICAL 9.8 UPGRADE The API call /InstallTab/exportFldr.asp is vulnerable to a semi-authenticated boolean-based blind SQL injectio