Unauthenticated License Replacement in Quest KACE Systems Management Appliance
CVE-2025-32978

7.5HIGH

Key Information:

Vendor

Quest

Status
KACE Systems Management Appliance
Vendor
CVE Published:
24 June 2025

What is CVE-2025-32978?

The Quest KACE Systems Management Appliance is exposed to a license replacement vulnerability that allows unauthenticated users to replace valid system licenses via a web interface designed for license renewal. This vulnerability can be exploited by attackers to substitute valid licenses with expired or trial versions, potentially leading to service interruptions and denial of access to legitimate users.

References

https://support.quest.com/kb/4379499/quest-response-to-ka...
https://seralys.com/research/CVE-2025-32978.txt
https://seclists.org/fulldisclosure/2025/Jun/25

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-32978 : Unauthenticated License Replacement in Quest KACE Systems Management Appliance