Vulnerabilidades do Quest Kace Systems Management Appliance
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Quest Kace Systems Management Appliance: 6 registro(s), com versões afetadas e correções.cpe:2.3:a:quest:kace_systems_management_appliance
CVE-2021-32088
Crítica · 9.8
CWE-384 27/07/2026
Session Fixation em Quest Kace Systems Management Appliance
An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. Certain API endpoints contain a rate-limiting feature to minimize a brute-force attack. This protection can be bypassed by removing the kboxid cookie.
CVE-2021-32087
Alta · 8.8
CWE-798 27/07/2026
Use of Hard-coded Credentials em Quest Kace Systems Management Appliance
An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It installs with default user credentials. The kbftp account has a password of getbxf, which is publicly known and documented. This allows remote attackers to trivially gain privileged access to the FTP service interface, which contains MySQL backups. Sensitive information is stored in the database, such as privileged credentials for other systems.
CVE-2021-32086
Crítica · 9.8
CWE-321 27/07/2026
An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It…
An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It uses a hardcoded symmetric encryption key to encrypt secrets in the MySQL databases. (This key is not unique for each installation.) An attacker that gains access to the MySQL server or a backup files can decrypt the secrets. Often, the decrypted secrets can be used to escalate privileges within KACE, or gain privileged access to unrelated systems or services.
CVE-2021-32085
Alta · 8.8
CWE-798 27/07/2026
Use of Hard-coded Credentials em Quest Kace Systems Management Appliance
An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It installs with default user credentials. The report and R1 MySQL accounts have a password of box747, which is publicly known and documented. This allows remote attackers to trivially gain privileged access to the MySQL databases. Sensitive information is stored in the database, such as privileged credentials for other systems.
CVE-2021-32084
Crítica · 9.8
CWE-284 27/07/2026
Improper Access Control em Quest Kace Systems Management Appliance
An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. If a customer restricts access to the web console by IP address or subnets, the API endpoints are not restricted. If credentials/API keys are known to an attacker, the appliance can still be accessed via the API, leading to a potential compromise of the entire environment that is configured for KACE.
CVE-2025-32975
Crítica · 10.0
KEV Alta · 61 CWE-287 24/06/2025
Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability
Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.x before 14.1.101 (Patch 4) contains an authentication bypass vulnerability that allows attackers to impersonate legitimate users without valid credentials. The vulnerability exists in the SSO authentication handling mechanism and can lead to complete administrative takeover.