CVE-2018-11138criticalunder attackransomwareCWE-78

CVE-2018-11138

Published · Updated

Follow this CVE+ Monitor KACE System Management Appliance

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 92%
from disclosure to weapon27 days
Published on NVDMay 31
1st PoC+27d
metasploitMay 31
CISA KEV+1394d
Action required by CISAfederal deadline: 2022-04-15

Apply updates per vendor instructions.

In short

An unprotected script in Quest KACE allows anyone on the internet to run any command they want on the server. This is extremely dangerous because attackers can take complete control of the system without needing a password.

Technical detail

CWE-78 (OS Command Injection) via unauthenticated access to '/common/download_agent_installer.php' in KACE 8.0.318. The script fails to validate user input and execute authorization checks, allowing remote attackers to inject arbitrary OS commands with system privileges. Impact includes complete system compromise.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by anonymous users and can be abused to execute arbitrary commands on the system.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.