EUVD-2021-34857

An issue was discovered in Quest KACE Systems Deployment Appliance SMA 11.0.273. Certain API endpoints contain a rate-limiting feature to minimize a brute-force attack. This protection can be bypassed by removing the kboxid cookie...

CVE-2021-32088

The Quest KACE Systems Deployment Appliance (SMA) 11.0.273 is vulnerable to a rate-limiting bypass. Specifically, certain API endpoints include a feature designed to mitigate brute-force attacks, but this protection can be circumvented by removing the kboxid cookie . Exploitation details and spec...

CVE-2021-32087

An issue was discovered in Quest KACE Systems Deployment Appliance SMA 11.0.273. It installs with default user credentials. The kbftp account has a password of getbxf, which is publicly known and documented. This allows remote attackers to trivially gain privileged access to the FTP service...