CVE-2021-32085

Received Received - Intake

Default Credentials in Quest KACE SMA Allowing MySQL Access

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: MITRE

Description

An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It installs with default user credentials. The report and R1 MySQL accounts have a password of box747, which is publicly known and documented. This allows remote attackers to trivially gain privileged access to the MySQL databases. Sensitive information is stored in the database, such as privileged credentials for other systems.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-27

Last Modified

2026-07-27

Generated

2026-07-28

AI Q&A

2026-07-28

EPSS Evaluated

N/A

NVD

CVE-2021-32085

Affected Vendors & Products

Vendor	Product	Version / Range
quest	kace_systems_deployment_appliance	11.0.273

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability involves Quest KACE Systems Deployment Appliance (SMA) 11.0.273 being installed with default user credentials. The report and R1 MySQL accounts use a publicly known password 'box747', allowing remote attackers to gain privileged access to the MySQL databases. Sensitive information, including credentials for other systems, is stored in these databases.

Detection Guidance

Check if the default MySQL credentials are still in use by attempting to log in with the username 'report' or 'R1' and password 'box747'. Use commands like 'mysql -u report -pbox747' or 'mysql -u R1 -pbox747' to verify access.

Impact Analysis

Attackers can exploit this to access sensitive data stored in the MySQL databases, including privileged credentials for other systems. This could lead to further compromise of connected systems, unauthorized access, or data breaches.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and security, such as GDPR and HIPAA, due to unauthorized access to sensitive data and potential data breaches. Organizations may face legal penalties and reputational damage.

Mitigation Strategies

Change the default passwords for the 'report' and 'R1' MySQL accounts to strong, unique passwords. Ensure no other systems rely on these default credentials. Review and secure all sensitive information stored in the database.

Hi! I’m here to help you understand CVE-2021-32085. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70