CVE-2021-43044
📋 TL;DR
Kaseya Unitrends Backup Appliance versions before 10.5.5 use a weak default SNMP community string, allowing attackers to read and potentially modify SNMP data. This affects all deployments using default SNMP configurations. The vulnerability enables unauthorized access to sensitive system information.
💻 Affected Systems
- Kaseya Unitrends Backup Appliance
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise leading to data exfiltration, ransomware deployment, or complete backup infrastructure takeover
Likely Case
Unauthorized access to sensitive backup metadata, configuration data, and system information
If Mitigated
Limited to no impact if SNMP is disabled or strong community strings are configured
🎯 Exploit Status
Simple SNMP queries with default community strings can exploit this vulnerability
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.5.5
Vendor Advisory: https://helpdesk.kaseya.com/hc/en-gb/articles/4412762258961
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Download and install version 10.5.5 from Kaseya support portal. 3. Apply update through appliance web interface. 4. Reboot appliance as prompted.
🔧 Temporary Workarounds
Disable SNMP Service
linuxCompletely disable SNMP daemon if not required
systemctl stop snmpd
systemctl disable snmpd
Change SNMP Community Strings
linuxReplace default community strings with strong, unique values
Edit /etc/snmp/snmpd.conf and change community strings
systemctl restart snmpd
🧯 If You Can't Patch
- Disable SNMP service immediately if not required
- Implement network segmentation to restrict SNMP traffic to management networks only
🔍 How to Verify
Check if Vulnerable:
Check SNMP configuration file for weak community strings: grep -i community /etc/snmp/snmpd.confCheck Version:
cat /etc/unitrends/versionVerify Fix Applied:
Verify version is 10.5.5 or later: cat /etc/unitrends/version📡 Detection & Monitoring
Log Indicators:
- SNMP authentication failures
- Unexpected SNMP queries from unauthorized sources
Network Indicators:
- SNMP traffic to/from backup appliance on UDP port 161
- SNMP queries using default community strings
SIEM Query:
source="snmpd" AND (community="public" OR community="private")🔗 References
- https://helpdesk.kaseya.com/hc/en-gb/articles/4412762258961
- https://www.cyberonesecurity.com/blog/exploiting-kaseya-unitrends-backup-appliance-part-1
- https://www.cyberonesecurity.com/blog/exploiting-kaseya-unitrends-backup-appliance-part-2
- https://helpdesk.kaseya.com/hc/en-gb/articles/4412762258961
- https://www.cyberonesecurity.com/blog/exploiting-kaseya-unitrends-backup-appliance-part-1
- https://www.cyberonesecurity.com/blog/exploiting-kaseya-unitrends-backup-appliance-part-2
