Remote Code Execution Vulnerability in Quest KACE K1000 Systems Management Appliance
CVE-2019-20504

9.8CRITICAL

Key Information:

Vendor

Quest

Status
Kace Systems Management
Vendor
CVE Published:
9 March 2020

What is CVE-2019-20504?

The Quest KACE K1000 Systems Management Appliance is susceptible to a vulnerability that allows remote attackers to execute arbitrary code via specially crafted shell metacharacters in the kuid parameter of the service/krashrpt.php file. Systems running versions prior to 6.4 SP3 (6.4.120822) are particularly at risk. This vulnerability underscores the importance of patch management and securing web applications against input manipulation attacks.

References

https://www.rcesecurity.com/2019/04/dell-kace-k1000-remot...
x_refsource_MISC

EPSS Score

47% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.