CVE-2021-32084

CriticalCVSS 9.8/10Last modified Aug 3, 2026

Description

An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. If a customer restricts access to the web console by IP address or subnets, the API endpoints are not restricted. If credentials/API keys are known to an attacker, the appliance can still be accessed via the API, leading to a potential compromise of the entire environment that is configured for KACE.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Jul 27, 2026
Last modified: Aug 3, 2026
NVD status: Analyzed

Related CVEs from 2021

CVE-2021-320858.8An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It installs with default user credentials. The report and CVE-2021-320869.8An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It uses a hardcoded symmetric encryption key to encrypt s CVE-2021-320878.8An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It installs with default user credentials. The kbftp acco CVE-2021-320889.8An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. Certain API endpoints contain a rate-limiting feature to CVE-2021-320899.8An issue was discovered on Zebra (formerly Motorola Solutions) Fixed RFID Reader FX9500 devices. An unauthenticated attacker can upload arbi CVE-2021-320909.8The dashboard component of StackLift LocalStack 0.12.6 allows attackers to inject arbitrary shell commands via the functionName parameter.CVE-2021-320916.1A Cross-site scripting (XSS) vulnerability exists in StackLift LocalStack 0.12.6.CVE-2021-320926.1A Cross-site scripting (XSS) vulnerability in the DocumentAction component of U.S. National Security Agency (NSA) Emissary 5.9.0 allows remo CVE-2021-320936.5The ConfigFileAction component of U.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to read arbitrary files vi CVE-2021-320948.8U.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to upload arbitrary files.CVE-2021-320958.1U.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to delete arbitrary files.CVE-2021-320968.8The ConsoleAction component of U.S. National Security Agency (NSA) Emissary 5.9.0 allows a CSRF attack that results in injecting arbitrary R