CVE-2021-32086
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
Quest KACE SMA 11.0.273 uses a hardcoded symmetric encryption key to encrypt secrets in the MySQL database. The key is not unique per installation, so an attacker with access to the MySQL server or backups can decrypt the secrets.
Risk Assessment
Decrypted secrets can enable privilege escalation within KACE or access to other systems, posing a serious security risk to the organization.
Recommendation
Update to a version where the encryption key is unique per installation and rotate all secrets stored in the database.
Other vulnerabilities in Quest KACE Systems Deployment Appliance
See all- CVE-2021-32088Critical
In Quest KACE SMA 11.0.273, the rate-limiting feature for API endpoints can be bypassed by removing the kboxid cookie, enabling brute-force attacks.
- CVE-2021-32084Critical
In Quest KACE SMA 11.0.273, access restrictions to the web console (e.g., by IP address) do not apply to API endpoints. If an attacker knows credentials or API keys, they can access the appliance via the API, potentially compromising the entire environment.
- CVE-2021-32087High
Quest KACE SMA 11.0.273 ships with default credentials for the kbftp account (password getbxf), which is publicly known. A remote attacker can gain privileged access to the FTP service containing MySQL backups with sensitive data.
- CVE-2021-32085High
Quest KACE SMA 11.0.273 ships with default credentials for the MySQL accounts report and R1 (password box747), which is publicly known. A remote attacker can gain privileged access to MySQL databases containing sensitive data.
Original NVD description (English source)
An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It uses a hardcoded symmetric encryption key to encrypt secrets in the MySQL databases. (This key is not unique for each installation.) An attacker that gains access to the MySQL server or a backup files can decrypt the secrets. Often, the decrypted secrets can be used to escalate privileges within KACE, or gain privileged access to unrelated systems or services.