CVE-2021-32087: Quest KACE SMA Auth Bypass Vulnerability

CVE-2021-32087 Overview

CVE-2021-32087 is a hardcoded credentials vulnerability in Quest KACE Systems Deployment Appliance (SMA) version 11.0.273. The appliance ships with a default kbftp account protected by the publicly documented password getbxf. Remote attackers can authenticate to the FTP service using these known credentials and access MySQL database backups. These backups contain privileged credentials for other integrated systems, enabling lateral movement across the enterprise. The vulnerability is classified under [CWE-798: Use of Hard-coded Credentials].

Critical Impact
Trivial remote authentication to the FTP interface exposes MySQL backups containing sensitive credentials for downstream systems, enabling privilege escalation and lateral movement.

Affected Products

Quest KACE Systems Deployment Appliance (SMA) 11.0.273
Quest KACE FTP service (kbftp account)
MySQL backup archives stored on the appliance

Discovery Timeline

2026-07-27 - CVE-2021-32087 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2021-32087

Vulnerability Analysis

The Quest KACE Systems Deployment Appliance provisions the kbftp FTP account during installation with a static password (getbxf). This credential is embedded in vendor documentation and publicly indexed. Any network-reachable attacker can authenticate to the FTP service without prior access or reconnaissance beyond a search engine query.

Once authenticated, the attacker interacts with MySQL backup files exposed through the FTP interface. These backups aggregate configuration data, integration secrets, and administrative credentials used by the appliance to manage remote endpoints. The result is credential harvesting that extends well beyond the appliance itself.

The EPSS score for this vulnerability sits at 0.293% with a percentile of 21.6, reflecting limited automated exploitation activity but not diminishing the ease of manual abuse.

Root Cause

The root cause is the use of hardcoded credentials shipped with the appliance and never rotated or forced to change during setup. The kbftp account exists to support internal file transfer operations but is exposed on the network with a static, well-known password. There is no first-boot enforcement to require an administrator to replace the default password before the FTP service becomes reachable.

Attack Vector

The attack path requires network access to the appliance FTP port and knowledge of the default kbftp:getbxf credentials, both of which are trivial to satisfy. An attacker connects to the FTP service, authenticates, and enumerates directories containing MySQL backup archives. The attacker downloads the backups, extracts stored credentials, and pivots to the additional systems referenced in the database. No exploit code or memory corruption technique is required — this is a configuration-level authentication weakness.

Explicit exploitation code is not required to reproduce this issue. Public documentation of the default credentials is sufficient. Refer to the Quest Response to Vulnerability Report for vendor guidance.

Detection Methods for CVE-2021-32087

Indicators of Compromise

Successful FTP authentication events using the kbftp username from unexpected source IP addresses
FTP RETR commands targeting MySQL backup files or database dump archives on the appliance
Outbound data transfers from the KACE appliance FTP service to unrecognized external hosts
Subsequent authentication attempts on downstream systems using credentials that appear in appliance backups

Detection Strategies

Enable verbose logging on the KACE FTP service and forward events to a centralized SIEM for correlation
Alert on any authentication to the kbftp account outside of documented internal automation sources
Baseline normal FTP file access patterns and flag deviations involving backup or database file extensions
Correlate KACE FTP activity with credential-use anomalies on systems whose credentials are stored in appliance backups

Monitoring Recommendations

Continuously monitor network traffic to the appliance FTP port from non-administrative subnets
Track file-integrity and access events on MySQL backup directories
Review authentication logs on all systems integrated with KACE for reuse of exposed credentials
Deploy network segmentation controls to restrict which hosts can reach the appliance FTP interface

How to Mitigate CVE-2021-32087

Immediate Actions Required

Change the kbftp account password immediately to a strong, unique value per vendor guidance
Restrict access to the appliance FTP service using firewall or ACL rules to trusted management hosts only
Rotate every credential stored in MySQL backups on the appliance, since these must be considered exposed
Audit appliance access logs for prior kbftp authentication events and investigate any unexpected sources

Patch Information

Quest addressed this issue through documentation and configuration guidance rather than a code patch. Review the Quest Response to Vulnerability Report and apply the recommended hardening steps. Download the latest supported appliance build from the Quest Product Download Page.

Workarounds

Disable the FTP service on the appliance if it is not required for operational workflows
Place the appliance behind a management-only VLAN with strict inbound access controls
Enforce credential rotation policies for all built-in service accounts as part of appliance provisioning
Encrypt or remove MySQL backup files that contain credentials for integrated systems

bash

# Example: restrict FTP access to a trusted management subnet only
iptables -A INPUT -p tcp --dport 21 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 21 -j DROP