CVE-2021-32088 in KACE Systems Deployment Appliance
Summary
by MITRE • 07/28/2026
An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. Certain API endpoints contain a rate-limiting feature to minimize a brute-force attack. This protection can be bypassed by removing the kboxid cookie.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/28/2026
The Quest KACE Systems Deployment Appliance SMA version 11.0.273 contains a critical security vulnerability that undermines its authentication protection mechanisms through improper session management and rate-limiting bypass techniques. This flaw resides within the appliance's API endpoint authentication system where rate-limiting measures are intended to prevent brute-force attacks against administrative credentials. The vulnerability specifically targets the kboxid cookie implementation which serves as a primary mechanism for tracking and limiting login attempts per session.
The technical exploitation of this vulnerability occurs through a simple yet effective method of cookie manipulation that completely circumvents the intended security controls. Attackers can remove or modify the kboxid cookie from their browser session to bypass the rate-limiting restrictions that would normally prevent repeated authentication attempts within a short timeframe. This cookie-based protection mechanism fails to properly validate session state on the server side, allowing unauthorized users to perform unlimited login attempts without triggering the protective rate-limiting features.
This vulnerability directly relates to CWE-305 authentication bypass issues and represents a significant weakness in the appliance's access control implementation. The flaw enables attackers to conduct extended brute-force campaigns against administrative accounts with minimal risk of detection or automatic account lockout. The operational impact extends beyond simple credential guessing as it allows for automated attack scripts to effectively test numerous password combinations without encountering the rate-limiting protections that should normally prevent such activities.
From an ATT&CK perspective this vulnerability maps to technique T1110.003 for credential stuffing and brute force attacks, while also relating to T1562.008 for bypassing security controls. The attack vector is particularly concerning as it requires minimal technical expertise to exploit, making it accessible to threat actors with basic knowledge of web application security principles. Network administrators face significant risk of unauthorized access to the appliance's administrative interface and potentially compromised management capabilities.
The mitigation strategy should focus on implementing robust session management that does not rely solely on client-side cookies for critical security controls. Organizations should consider implementing multi-factor authentication, strengthening account lockout policies, and ensuring server-side validation of all session identifiers regardless of client cookie state. Additionally, network segmentation and access control lists should be implemented to limit direct access to the appliance's administrative interfaces. Regular security updates and patch management processes must be established to address similar vulnerabilities in the appliance's software stack and prevent future exploitation attempts.