CVE-2021-32086
CVE-2021-32086 is a critical vulnerability in Quest KACE Systems Deployment Appliance 11.0.273 where a hardcoded symmetric encryption key is used to protect secrets in MySQL databases. This key is not unique per installation, allowing attackers with access to the database or backups to decrypt secrets and potentially escalate privileges or access other systems.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Quest KACE Systems Deployment Appliance (SMA) version 11.0.273
Real-world impact
Attackers could decrypt sensitive secrets stored in MySQL databases, leading to privilege escalation or unauthorized access to unrelated systems.
Why this severity
CVSS 9.8 (critical): High confidence in exploitability and severe impact on confidentiality, integrity, and availability.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No official fix documented in sources (NVD description does not specify a patch or required action).