CVE-2021-30120

CVE-2021-30120 describes a critical vulnerability in Kaseya VSA before version 9.5.7 that allows attackers to bypass two-factor authentication (2FA). This flaw stems from the client-side enforcement of 2FA, which can be circumvented using a local proxy to manipulate server responses. With a CVSS score of 7.5 (HIGH), this vulnerability has a network attack vector and low attack complexity, potentially leading to high integrity impacts by allowing unauthorized access to systems. While not listed in CISA's KEV catalog, the vulnerability has garnered significant community discussion and media coverage, including its association with the REvil ransomware attacks, indicating its real-world impact and importance.