PT-2018-10329 · Quest · Quest Kace System Management Appliance

Guido Leo + 1 · Published 2018-05-31 · Updated 2025-11-05 · CVE-2018-11138

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Quest KACE System Management Appliance version 8.0.318

Description The issue concerns the accessibility of the "/common/download agent installer.php" script by anonymous users, which can be exploited to execute arbitrary commands on the system.

Recommendations For Quest KACE System Management Appliance version 8.0.318, restrict access to the "/common/download agent installer.php" script to prevent anonymous users from executing arbitrary commands.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2018-11138

Affected Products

Quest Kace System Management Appliance

References · 9

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/http/quest_kace_systems_management_rce.rb · Exploit
• 🔥 https://exploit-db.com/exploits/44950 · Exploit
• 🔥 https://coresecurity.com/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities · Exploit
• https://osv.dev/vulnerability/CVE-2018-11138 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-11138 · Security Note
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-11138 · Note
• https://t.me/cvenotify/108379 · Telegram Post
• https://t.me/cveNotify/141848 · Telegram Post
• https://t.me/cvenotify/114858 · Telegram Post