CVE-2014-125113: Dell/Quest KACE K1000 Unauthenticated File Upload RCE
An unrestricted file upload vulnerability exists in Dell (acquired by Quest) KACE K1000 System Management Appliance version 5.0 - 5.3, 5.4 prior to 5.4.76849, and 5.5 prior to 5.5.90547 in the downloadagent.php endpoint. An attacker can upload arbitrary PHP files to a temporary web-accessible directory, which are later executed through inclusion in backend code that loads files under attacker-controlled paths.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-125113?
CVE-2014-125113 is classified as a high severity vulnerability due to its potential for allowing arbitrary file uploads.
How do I fix CVE-2014-125113?
To fix CVE-2014-125113, upgrade the Dell KACE K1000 System Management Appliance to version 5.4.76849 or later for version 5.4, and to version 5.5.90547 or later for version 5.5.
What versions are affected by CVE-2014-125113?
CVE-2014-125113 affects Dell KACE K1000 System Management Appliance versions 5.0 to 5.3, 5.4 prior to 5.4.76849, and 5.5 prior to 5.5.90547.
Can CVE-2014-125113 be exploited remotely?
Yes, an attacker can exploit CVE-2014-125113 remotely by uploading malicious PHP files to the affected system.
What type of vulnerability is CVE-2014-125113?
CVE-2014-125113 is an unrestricted file upload vulnerability found in the download_agent.php endpoint.