CVE-2018-11138: Quest KACE System Management Appliance Remote Command Execution Vulnerability
What It Is — The /common/download_agent_installer.php endpoint in Quest KACE System Management Appliance can be accessed without authentication and abused to execute arbitrary commands on the appliance.
Exploitability — Public proof‑of‑concept code exists; an attacker can trigger remote code execution over the network. The CVSS v3.1 base score is 9.8 (Critical).
Affected Products — Quest KACE System Management Appliance (all versions prior to the vendor‑released patch in 2018).
Why It Matters for Trust & Control Assurance
- Access‑control hygiene – Unauthenticated endpoints bypass the principle of least privilege, exposing a control gap that auditors will flag.
- Continuous monitoring – Detecting unexpected command‑execution activity requires log collection and real‑time alerting, evidence that a mature control‑assurance program can provide.
- Defensible audit trail – Demonstrating that the management interface is hardened and that any deviation is logged satisfies multiple framework requirements (e.g., NIST CSF 2.0 Identify/Protect).
Recommended Actions
- Apply the Quest‑issued patch immediately.
- Restrict network access to the appliance’s web interface to trusted management subnets.
- Enable and forward detailed web‑server and system logs to a SIEM for continuous monitoring.
- Conduct a post‑patch validation of the “unauthenticated remote execution” control and map the finding to your framework of record.
Source: CISA KEV – CVE‑2018‑11138