CVE-2021-32085: Quest KACE SMA Auth Bypass Vulnerability

CVE-2021-32085 Overview

CVE-2021-32085 affects Quest KACE Systems Deployment Appliance (SMA) version 11.0.273. The appliance installs with default MySQL user credentials that cannot be considered secret. The report and R1 MySQL accounts ship with the password box747, which is publicly documented. Remote attackers who reach the MySQL service can authenticate as these accounts and read privileged data. The database stores sensitive information, including credentials used to manage other systems, so exposure extends beyond the appliance itself. This weakness is classified under CWE-798: Use of Hard-coded Credentials.

Critical Impact
Attackers with network access to the MySQL service can log in with publicly known credentials and extract stored privileged credentials for downstream systems.

Affected Products

Quest KACE Systems Deployment Appliance (SMA) 11.0.273
MySQL report account (password box747)
MySQL R1 account (password box747)

Discovery Timeline

2026-07-27 - CVE-2021-32085 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2021-32085

Vulnerability Analysis

Quest KACE SMA 11.0.273 ships with pre-provisioned MySQL accounts named report and R1. Both accounts use the static password box747. The credentials are documented publicly and are identical across installations. Any attacker who can reach the MySQL listener from the network can authenticate and query the backend database. The database holds operational data for the deployment appliance, including credentials the appliance uses to reach managed endpoints. Exposure of those credentials enables lateral movement into systems that the KACE appliance manages.

Root Cause

The root cause is the use of hardcoded credentials for internal service accounts [CWE-798]. The vendor shipped fixed passwords for the report and R1 MySQL users. Administrators are not required to rotate these credentials during installation, and the values are published in product documentation.

Attack Vector

An attacker with network reachability to the MySQL port on the appliance connects using a standard MySQL client. Authentication succeeds with the published credentials. The attacker then issues SQL queries to read tables that store credentials, deployment artifacts, and configuration data. No user interaction is required. Exploitation requires only low privileges, in the form of network reachability and a valid TCP path to the database service.

No public exploit code is required. Standard database client tooling is sufficient. See the Quest KACE vulnerability response for the vendor's guidance.

Detection Methods for CVE-2021-32085

Indicators of Compromise

MySQL authentication events for user report or R1 originating from unexpected source addresses.
Outbound queries from the KACE appliance database against credential tables that do not match normal reporting workflows.
New MySQL sessions to the appliance from hosts outside the administrative management network.

Detection Strategies

Enable MySQL general query logging or audit logging on the appliance and forward records to a centralized log store for review.
Alert on any successful login for the report and R1 accounts from sources other than the appliance's own management processes.
Correlate database authentication with network flow data to identify off-subnet access to TCP/3306 on the appliance.

Monitoring Recommendations

Baseline expected MySQL client sources and alert on deviations.
Monitor for follow-on use of credentials extracted from the KACE database on downstream managed systems.
Track configuration changes on the appliance that alter MySQL bind addresses or firewall rules.

How to Mitigate CVE-2021-32085

Immediate Actions Required

Change the passwords for the report and R1 MySQL accounts to unique, high-entropy values.
Restrict network access to the MySQL service on the appliance to management hosts only, using host-based firewall rules or network ACLs.
Rotate any credentials stored in the appliance database that may have been exposed, including those used for managed endpoints.
Review MySQL logs for prior authentication events using the default credentials.

Patch Information

Quest published a response and remediation guidance in the Quest KACE knowledge base article 4293505. Administrators should obtain the latest appliance build from Quest Product Downloads and follow vendor instructions to update the default database credentials.

Workarounds

Bind the MySQL service to the loopback interface where the appliance architecture allows it.
Enforce network segmentation so the appliance's database port is not reachable from user or server subnets.
Require administrators to change all default service account passwords as part of the appliance provisioning runbook.

bash

# Configuration example: change the default MySQL passwords on the appliance
mysql -u root -p <<'SQL'
ALTER USER 'report'@'%' IDENTIFIED BY '<new-strong-password>';
ALTER USER 'R1'@'%' IDENTIFIED BY '<new-strong-password>';
FLUSH PRIVILEGES;
SQL