Actively exploited in the wild
Quest KACE System Management Appliance Remote Command Execution Vulnerability
Quest - KACE System Management Appliance · Listed in the CISA KEV since 2022-03-25. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2018-11138
CriticalCVSS 9.8KEVExploitation Probability (EPSS)
Very high risk100th percentile - higher than 100% of all known CVEs
Summary
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by anonymous users and can be abused to execute arbitrary commands on the system.
Risk Assessment
An unauthenticated user can gain full control over the KACE appliance, potentially leading to compromise of managed systems and data.
Recommendation
Restrict access to the script, block it for anonymous users, and apply available vendor patches.
Original NVD description (English source)
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by anonymous users and can be abused to execute arbitrary commands on the system.