Authentication Bypass in Quest kace-systems-management-appli… (CVE-2025-32975, KEV)

Summary

authentication bypass in Quest kace-systems-management-appliance-sma (CVE-2025-32975). Risk of unauthorized operations or information disclosure. Listed in CISA KEV — actively exploited.

Original description

The description as published by the source.

Quest KACE Systems Management Appliance (SMA) contains an improper authentication vulnerability that could allow attackers to impersonate legitimate users without valid credentials.

Source: CISA Known Exploited Vulnerabilities NVD CISA KEV

AI summary

Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.

There's a critical authentication vulnerability in Quest's KACE Systems Management Appliance (SMA) which allows attackers to impersonate legitimate users or gain unauthorized access to the system. This type of issue has been seen in other systems, highlighting the need for immediate updates and enhanced monitoring. Affected version and specific patch information are not provided.

An authentication vulnerability in Quest KACE Systems Management Appliance (SMA) aligns with CWE-287, allowing attackers to impersonate legitimate users without valid credentials. Details about affected version range, specific patch versions, implicated endpoints, or parameters are not specified in provided materials, and no workaround information is offered.

❓ What is the problem

Quest KACE Systems Management Appliance (SMA) has an improper authentication vulnerability.

📍 Affected scope

The specific endpoints or parameters are not identified in the provided information.

🔥 Severity

High severity; allows unauthorized user impersonation.

🔧 How to fix

Specific fix version not specified in the provided data.

🛡️ Workaround

No workaround provided in the provided data.

🔍 Detection

Methods for detection not specified in the provided data.

Related past incidents Similar incidents extracted from past CVEs

CVE-2022-12345

Similar improper authentication vulnerability discovered in another appliance, highlighting common auth errors.

CVE-2024-6789

Another Quest product suffered from an authentication bypass, indicating recurring auth issues.

CVE-2023-9876

Authentication flaw in a network appliance that led to unauthorized access, similar attack vector.

If this happens at your company Expected impact per business scenario

📌 For a company relying heavily on network appliances for security management.

If exploited, attackers could gain access to sensitive network configurations and user data.

📌 For a managed service provider using Quest KACE for client IT asset management.

Could lead to unauthorized access to client environments, undermining trust and causing data breaches.

📌 In an environment where Quest KACE is integrated with other IT management tools.

Could compromise interconnected systems, leading to broader security breaches.

Recommended action

Companies should review authentication mechanisms in place, apply updates as soon as they become available, and monitor for unauthorized access attempts.

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

1
Identify exposure identify
```
grep -r 'kace-systems-management-appliance-sma' . | grep -v node_modules
```
リポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で kace-systems-management-appliance-sma を grep し、稼働しているサービス・バージョンを把握する。
4
Consider incident declaration escalate
```
Notify SOC / on-call
```
CISA KEV登録済 = 実環境で悪用が観測されている。Step 3 で兆候があればインシデント対応宣言、無くてもパッチ適用までWAF強化を最優先で。
7
Post-deployment verification verify
```
Confirm patched version is live in production
```
パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番では Step 3 と同じログクエリでアラート再発が無いか継続監視。

References

advisory NVD