← Back

CVE-2025-32975

nvd nist
Published: Jun 24, 2025Modified: Jun 17, 2026CISA KEV

JSON object

Loading...
10.0
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 6.0
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.x before 14.1.101 (Patch 4) contains an authentication bypass vulnerability that allows attackers to impersonate legitimate users without valid credentials. The vulnerability exists in the SSO authentication handling mechanism and can lead to complete administrative takeover.

Affected (5)

Quest
1 product
Kace Systems Management Appliance
Configuration A
5 vulnerable
Vulnerable SoftwareAffected Versions
Quest
Kace Systems Management Appliance
From 13.0 to 13.0.385
Kace Systems Management Appliance
From 13.1 to 13.1.81
Kace Systems Management Appliance
From 13.2 to 13.2.183
Kace Systems Management Appliance
From 14.0 to 14.0.341
Kace Systems Management Appliance
From 14.1 to 14.1.101

Related CWEs

CWE-287
Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (5)

Source: cve@mitre.org
Mailing ListThird Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
US Government Resource

Timeline

No history available yet.