Actively exploited · Published May 31, 2018 · Assigned by mitre

CVE-2018-11138

Critical 9.8 Exploited Ransomware

In plain English

A critical-severity OS command injection in KACE System Management Appliance from Quest. Attackers are actively exploiting it in the wild (listed by CISA on March 25, 2022). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 91.7% (higher than 99.8% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei. Apply updates per vendor instructions.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)91.7%top 0.2% of all CVEs

Exploited in the wildYesCISA KEV since Mar 25, 2022

Attack tooling2Metasploit, Nuclei

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Apr 15, 2022.

Official description

The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by anonymous users and can be abused to execute arbitrary commands on the system.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

44950 exploit, x_refsource_EXPLOIT-DB
https://www.coresecurity.com/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities x_refsource_MISC
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-11138 government-resource