CVE-2021-32085CWE-798hardcoded-credentials

CVE-2021-32085

High · published July 28, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
43.8
In the wild
Unconfirmed
What it is

An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It installs with default user credentials. The report and R1 MySQL accounts have a password of box747, which is publicly known and documented. This allows remote attackers to trivially gain privileged access to the MySQL databases. Sensitive information is stored in the database, such as privileged credentials for other systems.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00527 · 43.8th percentile
Weakness
CWE-798 · Use of Hard-coded Credentials
Published
2026-07-28T02:16Z
Affected products (1)
ProductVersionsFixed in
quest/kace_systems_management_applianceall versions—
References (2)
https://support.quest.com/download-product-select · [email protected]https://support.quest.com/kace-systems-management-appliance/kb/4293505/quest-response-to-criticalstart-vulnerability-report · [email protected]
EPSS history
Timeline
  • 27 JUL 00:00Z
    An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273
    cvelistv5