Quest Kace Systems Management Appliance vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Quest Kace Systems Management Appliance: 6 record(s), with affected versions and fixes.cpe:2.3:a:quest:kace_systems_management_appliance
CVE-2021-32088
Critical · 9.8
CWE-384 Jul 27, 2026
Session Fixation in Quest Kace Systems Management Appliance
An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. Certain API endpoints contain a rate-limiting feature to minimize a brute-force attack. This protection can be bypassed by removing the kboxid cookie.
CVE-2021-32087
High · 8.8
CWE-798 Jul 27, 2026
Use of Hard-coded Credentials in Quest Kace Systems Management Appliance
An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It installs with default user credentials. The kbftp account has a password of getbxf, which is publicly known and documented. This allows remote attackers to trivially gain privileged access to the FTP service interface, which contains MySQL backups. Sensitive information is stored in the database, such as privileged credentials for other systems.
CVE-2021-32086
Critical · 9.8
CWE-321 Jul 27, 2026
An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It…
An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It uses a hardcoded symmetric encryption key to encrypt secrets in the MySQL databases. (This key is not unique for each installation.) An attacker that gains access to the MySQL server or a backup files can decrypt the secrets. Often, the decrypted secrets can be used to escalate privileges within KACE, or gain privileged access to unrelated systems or services.
CVE-2021-32085
High · 8.8
CWE-798 Jul 27, 2026
Use of Hard-coded Credentials in Quest Kace Systems Management Appliance
An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It installs with default user credentials. The report and R1 MySQL accounts have a password of box747, which is publicly known and documented. This allows remote attackers to trivially gain privileged access to the MySQL databases. Sensitive information is stored in the database, such as privileged credentials for other systems.
CVE-2021-32084
Critical · 9.8
CWE-284 Jul 27, 2026
Improper Access Control in Quest Kace Systems Management Appliance
An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. If a customer restricts access to the web console by IP address or subnets, the API endpoints are not restricted. If credentials/API keys are known to an attacker, the appliance can still be accessed via the API, leading to a potential compromise of the entire environment that is configured for KACE.
CVE-2025-32975
Critical · 10.0
KEV High · 61 CWE-287 Jun 24, 2025
Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability
Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.x before 14.1.101 (Patch 4) contains an authentication bypass vulnerability that allows attackers to impersonate legitimate users without valid credentials. The vulnerability exists in the SSO authentication handling mechanism and can lead to complete administrative takeover.