Overview
The vulnerability CVE-2025-32977 is a critical flaw found in Quest KACE Systems Management Appliance (SMA) that potentially allows an unauthenticated user to upload backup files to the system. This vulnerability has a significant impact as it could potentially compromise system integrity and result in data leakage.
This vulnerability is of major importance as it affects multiple versions of the Quest KACE Systems Management Appliance (SMA), a widely used software solution for unified endpoint management. Due to the weakness in the signature validation process, malicious backup content can be uploaded, thus compromising the integrity of the system.
Vulnerability Summary
CVE ID: CVE-2025-32977
Severity: Critical (9.6 CVSS Score)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: System integrity compromise and potential data leakage
Affected Products
A new way to communicate
Ameeba Chat is built on encrypted identity, not personal profiles.
Message, call, share files, and coordinate with identities kept separate.
- • Encrypted identity
- • Ameeba Chat authenticates access
- • Aliases and categories
- • End-to-end encrypted chat, calls, and files
- • Secure notes for sensitive information
Private communication, rethought.
Product | Affected Versions
Quest KACE Systems Management Appliance (SMA) | 13.0.x before 13.0.385
Quest KACE Systems Management Appliance (SMA) | 13.1.x before 13.1.81
Quest KACE Systems Management Appliance (SMA) | 13.2.x before 13.2.183
Quest KACE Systems Management Appliance (SMA) | 14.0.x before 14.0.341 (Patch 5)
Quest KACE Systems Management Appliance (SMA) | 14.1.x before 14.1.101 (Patch 4)
How the Exploit Works
The exploit works by taking advantage of the weakness in the signature validation process implemented by the Quest KACE Systems Management Appliance (SMA). The malicious user, without any authentication, can upload a backup file containing malicious content. Once uploaded, the backup file can be restored, leading to the compromise of the system integrity and potential data leakage.
Conceptual Example Code
Below is a conceptual example of how this vulnerability might be exploited. This is a sample HTTP request that uploads a malicious backup file to the system:
POST /backup/restore HTTP/1.1
Host: target.example.com
Content-Type: application/octet-stream
Content-Length: [length of the backup file]
[binary data of the backup file]