EUVD-2021-34856

An issue was discovered in Quest KACE Systems Deployment Appliance SMA 11.0.273. It uses a hardcoded symmetric encryption key to encrypt secrets in the MySQL databases. This key is not unique for each installation. An attacker that gains access to the MySQL server or a backup files can decrypt th...

CVE-2021-32087

The provided records confirm a vulnerability in Quest KACE Systems Deployment Appliance (SMA) version 11.0.273 where the system ships with default credentials. Specifically, the kbftp account is configured with the password getbxf, which is publicly known and documented. This enables remote attac...

CVE-2021-32088

CVE-2021-32088 affects Quest KACE Systems Deployment Appliance (SMA) 11.0.273. The vulnerability arises because a rate-limiting protection on certain API endpoints can be bypassed by removing the kboxid cookie, potentially allowing more brute-force attempts than intended. The available documents ...