CVE-2021-32087
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
Quest KACE SMA 11.0.273 ships with default credentials for the kbftp account (password getbxf), which is publicly known. A remote attacker can gain privileged access to the FTP service containing MySQL backups with sensitive data.
Risk Assessment
An attacker can access database backups containing confidential information, including credentials for other systems, potentially leading to privilege escalation.
Recommendation
Immediately change default passwords for all accounts, including kbftp, and restrict access to the FTP service.
Other vulnerabilities in Quest KACE Systems Deployment Appliance
See all- CVE-2021-32088Critical
In Quest KACE SMA 11.0.273, the rate-limiting feature for API endpoints can be bypassed by removing the kboxid cookie, enabling brute-force attacks.
- CVE-2021-32086Critical
Quest KACE SMA 11.0.273 uses a hardcoded symmetric encryption key to encrypt secrets in the MySQL database. The key is not unique per installation, so an attacker with access to the MySQL server or backups can decrypt the secrets.
- CVE-2021-32084Critical
In Quest KACE SMA 11.0.273, access restrictions to the web console (e.g., by IP address) do not apply to API endpoints. If an attacker knows credentials or API keys, they can access the appliance via the API, potentially compromising the entire environment.
- CVE-2021-32085High
Quest KACE SMA 11.0.273 ships with default credentials for the MySQL accounts report and R1 (password box747), which is publicly known. A remote attacker can gain privileged access to MySQL databases containing sensitive data.
Original NVD description (English source)
An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It installs with default user credentials. The kbftp account has a password of getbxf, which is publicly known and documented. This allows remote attackers to trivially gain privileged access to the FTP service interface, which contains MySQL backups. Sensitive information is stored in the database, such as privileged credentials for other systems.