CVE-2021-32087CWE-798hardcoded-credentials

CVE-2021-32087

High · published July 28, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
43.8
In the wild
Unconfirmed
What it is

An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It installs with default user credentials. The kbftp account has a password of getbxf, which is publicly known and documented. This allows remote attackers to trivially gain privileged access to the FTP service interface, which contains MySQL backups. Sensitive information is stored in the database, such as privileged credentials for other systems.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00527 · 43.8th percentile
Weakness
CWE-798 · Use of Hard-coded Credentials
Published
2026-07-28T02:16Z
Affected products (1)
ProductVersionsFixed in
quest/kace_systems_management_applianceall versions—
References (2)
https://support.quest.com/download-product-select · [email protected]https://support.quest.com/kace-systems-management-appliance/kb/4293505/quest-response-to-criticalstart-vulnerability-report · [email protected]
EPSS history
Timeline
  • 27 JUL 00:00Z
    An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273
    cvelistv5