CVE-2021-32084 in KACE Systems Deployment Appliance
Summary
by MITRE • 07/28/2026
An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. If a customer restricts access to the web console by IP address or subnets, the API endpoints are not restricted. If credentials/API keys are known to an attacker, the appliance can still be accessed via the API, leading to a potential compromise of the entire environment that is configured for KACE.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/28/2026
The vulnerability in Quest KACE Systems Deployment Appliance version 11.0.273 represents a critical authorization flaw that undermines the security controls implemented by organizations seeking to restrict access to their management interfaces. This issue manifests as a configuration inconsistency where IP-based access restrictions applied to the web console fail to extend to the application programming interface endpoints, creating an exploitable gap in the security perimeter.
The technical implementation of this vulnerability stems from improper access control enforcement within the appliance's authentication framework. When administrators configure IP address or subnet restrictions for the web console, these policies are correctly enforced at the user interface level but are bypassed for API endpoints that operate under the same authentication mechanisms. This discrepancy occurs because the API endpoints do not inherit or validate the same network-level access controls that govern the web interface, allowing unauthorized access when valid credentials or API keys are obtained through other means.
The operational impact of this vulnerability extends far beyond simple unauthorized access, as it enables attackers to compromise the entire KACE-managed environment. Once an attacker gains access through the unrestricted API endpoints, they can execute commands, modify system configurations, access sensitive data, and potentially escalate privileges within the appliance. The attack surface expands significantly since API endpoints typically provide more granular and powerful access than the web console interface, allowing for comprehensive system compromise and data exfiltration.
This vulnerability aligns with CWE-639: Authorization Bypass Through User-Controlled Key, which describes scenarios where applications fail to properly validate authorization when user-controllable input is used as a key or identifier. The issue also maps to ATT&CK technique T1078.004: Valid Accounts, Temporary Accounts, and Shared Accounts, as it allows attackers to leverage legitimate credentials to bypass network-level restrictions. Organizations implementing IP-based access controls for security purposes may be deceived into believing their systems are adequately protected when the API endpoints remain accessible to unauthorized parties.
The recommended mitigation strategies include implementing comprehensive access control policies that extend authentication validation to all application endpoints, including APIs. Administrators should configure network-level restrictions that apply uniformly across both web console and API interfaces, while also implementing additional security measures such as API key rotation, rate limiting, and enhanced monitoring of API access patterns. Additionally, organizations should conduct regular security assessments to identify similar configuration inconsistencies across their infrastructure and ensure proper segregation of duties through role-based access controls that prevent unauthorized system modifications or data access.