CVE-2021-32087 in KACE Systems Deployment Appliance
Summary
by MITRE • 07/28/2026
An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It installs with default user credentials. The kbftp account has a password of getbxf, which is publicly known and documented. This allows remote attackers to trivially gain privileged access to the FTP service interface, which contains MySQL backups. Sensitive information is stored in the database, such as privileged credentials for other systems.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/28/2026
The Quest KACE Systems Deployment Appliance version 11.0.273 presents a critical security vulnerability through its default configuration that includes hard-coded credentials for the kbftp account with the password getbxf. This default credential issue represents a fundamental failure in secure configuration management and violates industry best practices for system hardening. The vulnerability exists within the appliance's installation process where it ships with predetermined authentication credentials that are widely documented and publicly accessible, creating an immediately exploitable attack vector that requires no specialized knowledge or tools to leverage.
This security flaw constitutes a severe privilege escalation vulnerability that allows remote attackers to gain administrative access to the FTP service interface without requiring any advanced exploitation techniques. The kbftp account provides access to MySQL database backups stored within the appliance's file system, which contain sensitive information including credentials for other systems and privileged accounts. This creates a cascading security risk where initial unauthorized access can lead to broader compromise of connected systems and networks. The vulnerability directly maps to CWE-798, which addresses the use of hard-coded credentials, and represents a classic example of insecure default configurations that persistently undermine system security post-deployment.
The operational impact of this vulnerability extends beyond simple unauthorized access to encompass potential data breaches, privilege escalation attacks, and system compromise across interconnected environments. Attackers who discover this default credential can trivially access database backups containing sensitive information such as system credentials, configuration details, and potentially user account information. This allows for lateral movement within networks and could enable attackers to escalate privileges beyond the initial compromised FTP service to other systems that rely on the same credential stores. The vulnerability's impact is amplified by its remote accessibility and the fact that no authentication or authorization controls are required to exploit it.
Security mitigation strategies should focus on immediate credential changes and configuration hardening of the affected appliance. Organizations must implement mandatory credential rotation policies that require administrators to change default accounts and passwords upon initial system deployment. Network segmentation and access control measures should be implemented to limit exposure of the appliance's FTP service to unauthorized networks, while regular security audits should verify that no default credentials remain active within the environment. This vulnerability demonstrates the critical importance of following the principle of least privilege and implementing robust configuration management practices as outlined in cybersecurity frameworks such as NIST SP 800-123 and ISO/IEC 27001, which emphasize the need for secure system initialization and ongoing security monitoring to prevent exploitation of known vulnerabilities through default credentials.