{"id":"CVE-2018-11138","kind":"vulnerability","aliases":["CVE-2018-11138"],"related":[],"title":"Quest KACE System Management Appliance: Quest KACE System Management Appliance Remote Command Execution Vulnerability","description":"The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance is accessible by anonymous users and can be abused to perform remote code execution.\n\nCISA required action: Apply updates per vendor instructions.","summary":"Quest KACE SMA's /common/download_agent_installer.php is reachable without authentication and lets an attacker inject OS commands via the orgid parameter (chained with a time-based SQLi to learn required parameters), giving remote code execution as the web server user, with a documented root-privilege-escalation chain via the Sudo Server module. CISA KEV lists it as actively exploited, including in ransomware campaigns.","severity":"critical","cvss":10.0,"epss":0.91719,"exploited":true,"exploited_at":"2022-03-25T00:00:00+00:00","products":[{"name":"Quest KACE System Management Appliance","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Quest KACE System Management Appliance","fixed":["7.0.121307","7.1.150","7.2.103","8.0.320","8.1.108","9.0.270"],"affected":"< 7.0.121307 (7.x line), < 7.1.150, < 7.2.103, < 8.0.320, < 8.1.108, < 9.0.270","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["appliance","exploited","infrastructure","quest-kace","ransomware","self-hosted","unauthenticated-rce"],"not_affected_if":["unknown"],"how_to_check":"From outside the appliance, send an unauthenticated GET to http://<kace-host>/common/download_agent_installer.php?platform=windows&serv=<sha256>&orgid=1&version=<agent-version>. If the appliance responds (rather than 404/redirect-to-login), the endpoint is exposed and the appliance is likely unpatched if its build predates the fixed builds below. Confirm the installed SMA build number in the admin console (Settings > Support > appliance version) against the fixed builds.","fix":"Apply Quest patch SEC2018_20180410 (support.quest.com KB 4210065), or upgrade to a build that already contains it: 7.0.121307, 7.1.150, 7.2.103, 8.0.320, 8.1.108, or 9.0.270 and later. The hotfix reboots the appliance.","status":"open","published_at":"2018-05-31T18:29:00+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:20:03+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.75,"triage":{"at":"2026-10-23T21:20:03Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor update for Quest KACE System Management Appliance per vendor instructions; the fixed version is unknown from the sources.","reach":"unknown","impact":"high","summary":"The Quest KACE System Management Appliance exposes /common/download_agent_installer.php without requiring login, and an attacker can abuse it to run commands on the appliance. CISA lists it as actively exploited, and the tags mark it as used in ransomware campaigns.","category":"infrastructure","who_cares":["quest-kace","self-hosted","appliance"],"confidence":0.8,"needs_auth":"no","worst_case":"Anonymous attacker runs commands on the KACE appliance server","analyst_note":"Find the fixed version and the vendor advisory for CVE-2018-11138 and a way to test whether the download_agent_installer.php endpoint is reachable; the sources give neither.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000473,"input_tokens":2853,"output_tokens":375,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the fixed version and the vendor advisory for CVE-2018-11138 and a way to test whether the download_agent_installer.php endpoint is reachable; the sources give neither.","search":"'-11138':17A,20A '-2018':16A,19A '/common/download_agent_installer.php':48B,109C 'abus':126C 'access':119C 'action':134C 'activ':102B 'anonym':121C 'appli':135C 'applianc':5A,10A,31B,117C 'appliance':25A,30A 'attack':56B 'authent':52B 'base':69B 'campaign':107B 'chain':64B,91B 'cisa':97B,132C 'code':77B,130C 'command':12A,59B 'cve':15A,18A 'document':86B 'escal':90B 'execut':13A,78B,131C 'exploit':32B,103B 'give':75B 'host':40B 'includ':104B 'infrastructur':33B 'inject':57B 'instruct':139C 'kace':2A,7A,22A,27A,36B,45B,114C 'kev':98B 'learn':72B 'let':54B 'list':99B 'manag':4A,9A,116C 'management':24A,29A 'modul':96B 'orgid':62B 'os':58B 'paramet':63B,74B 'per':137C 'perform':128C 'privileg':89B 'quest':1A,6A,21A,26A,35B,44B,113C 'quest-kac':34B 'ransomwar':37B,106B 'rce':43B 'reachabl':50B 'remot':11A,76B,129C 'requir':73B,133C 'root':88B 'root-privilege-escal':87B 'script':110C 'self':39B 'self-host':38B 'server':82B,95B 'sma':46B 'sqli':70B 'sudo':94B 'system':3A,8A,23A,28A,115C 'time':68B 'time-bas':67B 'unauthent':42B 'unauthenticated-rc':41B 'updat':136C 'user':83B,122C 'vendor':138C 'via':60B,92B 'vulner':14A 'web':81B 'without':51B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2018-05-31T18:29:00+00:00","kev":{"dateAdded":"2022-03-25","dueDate":"2022-04-15","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2018-11138","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-11138","severity":null,"published_at":"2022-03-25T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T10:39:07+00:00","note":null},{"source":"epss","external_id":"CVE-2018-11138","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-11138","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"analyst","external_id":"CVE-2018-11138:54","url":null,"severity":null,"published_at":"2026-10-23T21:20:42+00:00","modified_at":"2026-10-23T21:20:42+00:00","first_seen_at":"2026-10-23T21:20:42+00:00","fetched_at":"2026-10-23T21:20:42+00:00","note":"Primary sources: Core Security CORE-2018-0004 (section 7.1) confirms the unauthenticated command-injection path via /common/download_agent_installer.php, exploiting an SQLi in the orgid parameter to inject OS commands (root cause). Vendor fix is Quest KB 4210065 (patch SEC2018_20180410): fixes shipped in SMA 7.0.121307, 7.1.150, 7.2.103, 8.0.320, 8.1.108, and 9.0.270+; versions prior to these across the 7.x/8.x lines are vulnerable. Exploitability check: an unauthenticated GET to /common/download_agent_installer.php on the appliance (any response other than an auth redirect/404, e.g. HTTP 200 with agent-download behavior) indicates the endpoint is reachable and the instance is unpatched for this issue. No further patch history found post-9.0.270 for this specific CVE; vendor did not publish a CVSS score in the advisory but NVD/Rapid7 rate it 9.8 critical. CISA KEV confirms active exploitation (tags already note ransomware use)."},{"source":"nvd","external_id":"CVE-2018-11138","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-11138","severity":null,"published_at":"2018-05-31T18:29:00+00:00","modified_at":"2026-08-13T05:17:15+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[{"id":951,"url":"https://www.coresecurity.com/core-labs/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities","title":"CORE-2018-0004: Quest KACE SMA Multiple Vulnerabilities","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":950,"url":"https://support.quest.com/kb/4210065/security-vulnerability-patch-sec2018_20180410","title":"Quest KB 4210065: Security Vulnerability Patch (SEC2018_20180410)","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}