CVE-2018-11138
Quest KACE System Management Appliance Remote Command Execution Vulnerability
Description
CVE-2018-11138 is a critical unauthenticated remote code execution vulnerability in Quest KACE Systems Management Appliance (SMA) that allows remote attackers to execute arbitrary commands on the underlying operating system without any authentication. The vulnerability exists in the appliance's web interface, which fails to properly validate user input before passing it to system commands. CISA has confirmed active exploitation and added CVE-2018-11138 to the Known Exploited Vulnerabilities catalog, and it is a confirmed ransomware attack vector. With an EPSS score of 92.0% (99.6th percentile), this vulnerability poses an immediate critical threat to any organization running a vulnerable Quest KACE SMA.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| quest | kace system management appliance | 8.0.318 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://www.coresecurity.com/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities(Exploit, Technical Description, Third Party Advisory)
- https://www.exploit-db.com/exploits/44950/(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-11138(US Government Resource)
Weakness Type
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-78 describes a weakness where software constructs operating system commands using externally-influenced input without properly neutralizing special elements that could modify the intended command. In CVE-2018-11138, the Quest KACE SMA web interface passes user-supplied input to system commands without adequate sanitization, allowing an unauthenticated remote attacker to inject and execute arbitrary OS commands on the appliance.
Learn more: CWE-78 — OS Command Injection
Impact Analysis
CVE-2018-11138 enables unauthenticated remote code execution on Quest KACE Systems Management Appliances, which are centralized IT management platforms used to deploy software, manage patches, inventory assets, and control endpoints across enterprise networks. Compromise of a KACE SMA gives attackers access to a system that has administrative control over potentially thousands of managed endpoints, creating a catastrophic force-multiplier effect. An attacker exploiting this vulnerability can execute arbitrary commands on the appliance, access all managed device information, push malicious software to managed endpoints, harvest stored credentials, and use the appliance's trusted network position to move laterally across the organization. The confirmed use as a ransomware attack vector and the EPSS score of 92.0% (99.6th percentile) confirm active and widespread exploitation.
Exploit Maturity
CVE-2018-11138 is actively exploited in the wild and is confirmed as a ransomware attack vector by CISA. The vulnerability requires no authentication and can be exploited through the web interface, making it accessible to automated scanning and attack tools. The EPSS score of 92.0% (99.6th percentile) reflects very high exploitation probability. The high value of systems management appliances as targets — due to their administrative access to managed endpoints — makes CVE-2018-11138 particularly attractive to threat actors seeking to maximize the impact of a single compromise.
Remediation
- Apply patches from Quest immediately by updating the KACE SMA to the latest available firmware version that addresses CVE-2018-11138, as required by the CISA KEV directive.
- Restrict network access to the KACE SMA web interface to trusted management networks only, ensuring it is not accessible from untrusted networks or the public internet.
- Audit the KACE SMA for indicators of compromise, including unauthorized software deployments, unexpected script executions, modified configurations, and any signs of credential harvesting from the management database.
- Review all software deployment and patching activities performed through the KACE SMA to identify any unauthorized or suspicious packages that may have been pushed to managed endpoints.
- Change all administrative credentials on the KACE SMA and rotate any credentials stored within the appliance for managed device access, as these may have been compromised during exploitation.
Technical Details
CVE-2018-11138 is an OS command injection vulnerability (CWE-78) in the web interface of the Quest KACE Systems Management Appliance. The vulnerability exists because user-supplied input is passed to operating system commands without proper validation or sanitization. An unauthenticated remote attacker can exploit this flaw by sending crafted HTTP requests to the KACE SMA web interface that include command injection payloads in request parameters. The injected commands are executed on the underlying operating system with the privileges of the web application process. Quest KACE SMA is an enterprise systems management platform that provides software deployment, patch management, asset inventory, and endpoint management capabilities, making its compromise particularly impactful due to its administrative access to managed infrastructure.
Frequently Asked Questions
Is CVE-2018-11138 being actively exploited?
Yes, CVE-2018-11138 is actively exploited in the wild and is listed in the CISA Known Exploited Vulnerabilities catalog as a confirmed ransomware attack vector. The EPSS score of 92.0% (99.6th percentile) confirms very high exploitation activity.
What products are affected by CVE-2018-11138?
CVE-2018-11138 affects the Quest KACE Systems Management Appliance (SMA). The vulnerability is in the web interface used for managing the appliance and its managed endpoints.
How do I fix CVE-2018-11138?
Update the Quest KACE SMA to the latest firmware version that addresses this vulnerability. Restrict network access to the management interface to trusted networks only. After patching, audit the appliance for indicators of compromise and rotate all stored credentials.
How severe is CVE-2018-11138?
CVE-2018-11138 is rated CRITICAL as it enables unauthenticated remote code execution on a systems management platform. The EPSS score of 92.0% (99.6th percentile) indicates very high exploitation probability, and it is a confirmed ransomware delivery mechanism. Compromise of a KACE SMA gives attackers administrative access to all managed endpoints, creating a force-multiplier effect.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.