Remote Access Weakness in Quest KACE Systems Deployment Appliance

CVE-2021-32085

What is CVE-2021-32085?

A significant security vulnerability exists within the Quest KACE Systems Deployment Appliance version 11.0.273, allowing unauthorized remote access to MySQL databases due to the use of default user credentials. The default passwords for critical accounts like report and R1 MySQL, which are publicly documented, pose a considerable risk as they enable attackers to gain privileged access easily. This access can lead to the exposure of sensitive information, including privileged credentials related to other systems. Organizations using this product must take immediate steps to secure their installations and change default settings to mitigate potential exploitation.

References