Quest KACE System Management Appliance Remote Command Execution Vulnerability
Quest · KACE System Management Appliance
Date added (CISA)
2022-03-25
Remediation due
2022-04-15
Known ransomware use
Yes
Remediation priority
P1 — known ransomware use · past CISA due date
Description
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance is accessible by anonymous users and can be abused to perform remote code execution.