CVE-2021-32084: Critical severity Quest KACE Systems Deployment Appliance (SMA) vulnerability
An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. If a customer restricts access to the web console by IP address or subnets, the API endpoints are not restricted. If credentials/API keys are known to an attacker, the appliance can still be accessed via the API, leading to a potential compromise of the entire environment that is configured for KACE.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
If restricting access to the KACE Systems Deployment Appliance (SMA) web console by IP address/subnets, also restrict access to the API endpoints using network controls (e.g., firewall/ACL) so that API traffic is limited to the same permitted IPs/subnets.
Event History
Frequently Asked Questions
What is the severity of CVE-2021-32084?
CVE-2021-32084 has a severity rating of critical with a CVSS score of 9.8.
What is the impact of CVE-2021-32084?
CVE-2021-32084 allows an attacker with known credentials or API keys to access the Quest KACE Systems Deployment Appliance despite IP address restrictions.
How can I mitigate CVE-2021-32084?
To mitigate CVE-2021-32084, ensure that API keys and credentials are kept secure and consider limiting API access through additional security measures.
Which software versions are affected by CVE-2021-32084?
CVE-2021-32084 affects Quest KACE Systems Deployment Appliance version 11.0.273.
Is there a patch available for CVE-2021-32084?
At this time, please check with the Quest support site for any available patches or updates addressing CVE-2021-32084.