Quest KACE Systems Deployment Appliance vulnerabilities

In Quest KACE SMA 11.0.273, the rate-limiting feature for API endpoints can be bypassed by removing the kboxid cookie, enabling brute-force attacks.

Quest KACE SMA 11.0.273 uses a hardcoded symmetric encryption key to encrypt secrets in the MySQL database. The key is not unique per installation, so an attacker with access to the MySQL server or backups can decrypt the secrets.

In Quest KACE SMA 11.0.273, access restrictions to the web console (e.g., by IP address) do not apply to API endpoints. If an attacker knows credentials or API keys, they can access the appliance via the API, potentially compromising the entire environment.

Quest KACE SMA 11.0.273 ships with default credentials for the kbftp account (password getbxf), which is publicly known. A remote attacker can gain privileged access to the FTP service containing MySQL backups with sensitive data.

Quest KACE SMA 11.0.273 ships with default credentials for the MySQL accounts report and R1 (password box747), which is publicly known. A remote attacker can gain privileged access to MySQL databases containing sensitive data.