CVE-2021-32084
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
In Quest KACE SMA 11.0.273, access restrictions to the web console (e.g., by IP address) do not apply to API endpoints. If an attacker knows credentials or API keys, they can access the appliance via the API, potentially compromising the entire environment.
Risk Assessment
An attacker can bypass network restrictions and gain full access to the appliance, potentially leading to a takeover of the entire KACE environment.
Recommendation
Update to a version where IP restrictions also apply to the API and implement strong multi-factor authentication for API access.
Original NVD description (English source)
An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. If a customer restricts access to the web console by IP address or subnets, the API endpoints are not restricted. If credentials/API keys are known to an attacker, the appliance can still be accessed via the API, leading to a potential compromise of the entire environment that is configured for KACE.