Logic Flaw in Two-Factor Authentication in Quest KACE Systems Management Appliance

CVE-2025-32976

What is CVE-2025-32976?

The KACE Systems Management Appliance from Quest is affected by a logic flaw within its implementation of two-factor authentication. This vulnerability allows authenticated users to bypass the Time-based One-Time Password (TOTP) requirements of the 2FA process. As a result, malicious actors with valid credentials can exploit this vulnerability to gain elevated access, posing serious security risks to the affected systems. Organizations using this appliance should urgently apply necessary patches to mitigate the risks associated with this flaw.

References