CVE-2025-32975

The vulnerability (CWE-287 — improper authentication) lies in the SSO (Single Sign-On) authentication handling mechanism. An attacker, remotely and without any privileges or user interaction, can craft a request that will be incorrectly treated by the system as coming from an authenticated user. As a result, the attacker is able to successfully impersonate any user, including an administrator, without knowing their password or other authentication credentials.

An attacker can obtain full administrative privileges over the KACE SMA device, which consequently gives them control over managed IT resources — complete takeover of infrastructure management system (compromise of confidentiality, integrity, and availability).

Quest KACE SMA must be immediately updated to version: 13.0.385, 13.1.81, 13.2.183, 14.0.341 (Patch 5) or 14.1.101 (Patch 4) in accordance with the vendor's advisory available at: https://support.quest.com/kb/4379499. Until the patch is applied, it is recommended to restrict access to the management interface only to trusted networks.

Quest KACE Systems Management Appliance (SMA) in versions: 13.0.x prior to 13.0.385, 13.1.x prior to 13.1.81, 13.2.x prior to 13.2.183, 14.0.x prior to 14.0.341 (Patch 5), and 14.1.x prior to 14.1.101 (Patch 4)

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Quest KACE Systems Management Appliance (SMA) contains an improper authentication vulnerability that could allow attackers to impersonate legitimate users without valid credentials.