Critical · published May 31, 2018
CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 99.8th percentile for exploit probability.
🚨 Access to the wrong script can lead to chaos! The '/common/download_agent_installer.php' in Quest KACE lets anyone execute commands with no authentication. 🔥 Think of it like leaving the front door of a high-security facility wide open and inviting anyone to waltz in and take control of the security systems—total mayhem! 🤯 An attacker can exploit this vulnerability to run arbitrary commands on the server, potentially compromising sensitive data, altering configurations, or even bringing the entire system to its knees. This is absolutely devastating for any organization relying on KACE for management. ⚡
Think of it like leaving the front door of a high-security facility wide open and inviting anyone to waltz in and take control of the security systems—total mayhem! 🤯 This vulnerability allows anonymous users to access the '/common/download_agent_installer.php' script, which can be abused to execute arbitrary commands on the system without any authentication checks.
An attacker can exploit this vulnerability to run arbitrary commands on the server, potentially compromising sensitive data, altering configurations, or even bringing the entire system to its knees. This is absolutely devastating for any organization relying on KACE for management. ⚡ To protect your systems, urgently patch to version 8.0.319 or higher. Review your access controls and limit permissions to this script to authorized users only. Make sure to audit your system for any signs of exploitation. 🛡️ You've got this! Take action now to secure your system and block this critical vulnerability! 💪🛡️
| Product | Versions | Fixed in |
|---|---|---|
| quest/kace_system_management_appliance | all versions | — |