CVE-2018-11138

KEV · Ransomware

Quest KACE System Management Appliance Remote Command Execution Vulnerability

Vendor / Project: Quest
Product: KACE System Management Appliance
Date added: Mar 25, 2022
Due date: Apr 15, 2022
Known ransomware use: Known
CWEs: CWE-78

Description

The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance is accessible by anonymous users and can be abused to perform remote code execution.

Required action

Apply updates per vendor instructions.

Notes

https://nvd.nist.gov/vuln/detail/CVE-2018-11138