CVE-2021-30120
CVSS v3
7.5
HIGH
EPSS Score
5.7 %
exploit probability, as of 2026-09-25
CISA KEV
No
known exploited
Exploitation
—
SSVC status
Description
Kaseya VSA before 9.5.7 allows attackers to bypass the 2FA requirement. The need to use 2FA for authentication in enforce client-side instead of server-side and can be bypassed using a local proxy. Thus rendering 2FA useless. Detailed description --- During the login process, after the user authenticates with username and password, the server sends a response to the client with the booleans MFARequired and MFAEnroled. If the attacker has obtained a password of a user and used an intercepting proxy (e.g. Burp Suite) to change the value of MFARequered from True to False, there is no prompt for the second factor, but the user is still logged in.
Technical details
- Published
- 2021-07-09
Frequently asked questions
What is CVE-2021-30120?
Kaseya VSA before 9.5.7 allows attackers to bypass the 2FA requirement. The need to use 2FA for authentication in enforce client-side instead of server-side and can be bypassed using a local proxy. Thus rendering 2FA useless. Detailed description --- During the login process, after the user authenticates with username and password, the server sends a response to the client with the booleans MFARequired and MFAEnroled. If the attacker has obtained a password of a user and used an intercepting proxy (e.g. Burp Suite) to change the value of MFARequered from True to False, there is no prompt for the second factor, but the user is still logged in.
Is CVE-2021-30120 actively exploited?
Active exploitation of CVE-2021-30120 has not been confirmed. Its EPSS score was 5.7% on 2026-09-25, the estimated probability of exploitation in the next 30 days.
What is the CVSS score for CVE-2021-30120?
CVE-2021-30120 has a CVSS v3 base score of 7.5 (HIGH severity).
Is CVE-2021-30120 affecting your environment?
Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.
No credit card required · 500 free checks/month · Free API key
Other 2021 vulnerabilities worth triaging
Ranked by exploit probability (EPSS).