critical9.8Known exploitedPublic exploit code
CVE-2018-11138
Quest KACE System Management Appliance Remote Command Execution Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-03-25. Federal due date: 2022-04-15.
Apply updates per vendor instructions.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Quest KACE Systems Management - Command Injection (Metasploit)2018-06-27 · remote · unix · Verified
Impact
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by anonymous users and can be abused to execute arbitrary commands on the system.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Quest | Kace System Management Appliance | Version 8.0.318 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- https://www.coresecurity.com/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities
- https://www.exploit-db.com/exploits/44950/
- https://www.coresecurity.com/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities
- https://www.exploit-db.com/exploits/44950/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-11138