CVE-2018-11138

What is Quest KACE SMA?

The KACE System Management Appliance (SMA) is an enterprise IT asset and endpoint management platform (originally from KACE Networks, later Dell, now Quest Software) used by organizations to inventory hardware/software, push patches, and deploy management agents across large fleets of desktops and servers. Because KACE SMA has privileged access to every managed endpoint — it exists specifically to install software and run scripts on them — compromising the appliance itself is a direct path to compromising the entire managed fleet.

Overview

CVE-2018-11138 is a remote command execution vulnerability in the KACE SMA web interface. The /common/download_agent_installer.php endpoint, intended to let already-provisioned devices download the management agent installer, is reachable without any authentication and can be manipulated to execute arbitrary commands on the appliance's underlying OS.

Technical Details

The flaw (CWE-78, OS Command Injection) stems from the endpoint passing attacker-controllable input into a system-level call used to generate or serve the installer package, without adequately validating or escaping it. Because the script sits outside the appliance's normal authentication boundary — it must be reachable pre-enrollment so that unconfigured endpoints can fetch the agent — there is no login requirement standing between an attacker and the vulnerable code path. This gives an unauthenticated, remote attacker full command execution with a single crafted HTTP request (CVSS 9.8: no privileges, no user interaction, network vector).

Discovery

The vulnerability was addressed by Quest/Dell through their standard security update process for KACE SMA; no independent named researcher disclosure is confidently documented for this specific CVE.

Exploitation Context

CISA's KEV listing confirms this vulnerability has been exploited in the wild, and its inclusion alongside a ransomware-use flag reflects its value as an initial-access and lateral-movement vector: compromising the central systems-management server that already has trusted, privileged reach into every endpoint is an efficient way to pivot to mass deployment of ransomware payloads across an entire organization.

Remediation

1. Identify all KACE SMA appliances in your environment and confirm the installed version against Quest's advisories.
2. Apply the vendor-supplied patch or upgrade to a fixed KACE SMA release immediately.
3. Restrict network access to the KACE SMA management interface to trusted internal segments only — it should never be exposed directly to the internet.
4. Review appliance and agent-deployment logs for unexpected installer downloads or command execution around the download_agent_installer.php endpoint.
5. Given the ransomware association, treat any appliance suspected of compromise as a potential fleet-wide incident and audit connected endpoints for unauthorized agent pushes.