CVE-2021-32085 in KACE Systems Deployment Appliance
Summary
by MITRE • 07/28/2026
An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It installs with default user credentials. The report and R1 MySQL accounts have a password of box747, which is publicly known and documented. This allows remote attackers to trivially gain privileged access to the MySQL databases. Sensitive information is stored in the database, such as privileged credentials for other systems.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/28/2026
The Quest KACE Systems Deployment Appliance version 11.0.273 contains a critical security vulnerability stemming from improper default credential configuration that fundamentally undermines system security posture. This vulnerability represents a classic case of weak authentication mechanisms where default administrative accounts are provisioned with easily guessable passwords that have been publicly documented and widely disseminated within cybersecurity communities. The specific accounts affected include the report and R1 MySQL accounts, both configured with the password "box747" which serves as a well-known default credential across multiple security research databases and vulnerability assessments.
This flaw directly maps to CWE-798, which categorizes the use of hard-coded credentials in software applications, and represents a severe configuration management failure that allows unauthenticated remote attackers to immediately establish privileged access to the underlying database infrastructure. The vulnerability exists at the authentication layer where default accounts are enabled without requiring explicit password changes during initial deployment, creating an inherent security weakness that persists until administrative intervention occurs. The implications extend beyond simple credential compromise as these accounts possess elevated privileges necessary for database operations and can access sensitive information stored within the MySQL databases.
The operational impact of this vulnerability is substantial given that the affected database contains privileged credentials for other systems within the enterprise environment. This creates a potential attack vector where an initial compromise of the KACE appliance can lead to lateral movement throughout the network infrastructure, allowing attackers to escalate privileges and gain access to additional systems that rely on credentials stored in the compromised database. The vulnerability enables unauthorized data exfiltration, system modification, and potential disruption of critical deployment and management functions that the appliance supports within enterprise environments.
Security professionals should immediately address this vulnerability by implementing mandatory password change policies during initial deployment, disabling default accounts when not required, and establishing robust credential management procedures as outlined in the NIST Special Publication 800-123. Organizations must also conduct comprehensive inventory assessments to identify all instances of the affected appliance version and ensure that default credentials have been changed to strong, unique passwords. The remediation process should include network segmentation to limit access to the appliance, implementation of intrusion detection systems, and regular security audits to verify that accounts remain secure. Additionally, this vulnerability aligns with ATT&CK technique T1078 which covers valid accounts and privilege escalation through the use of default credentials, demonstrating how such misconfigurations can facilitate broader attack campaigns.