Overview
The CVE-2025-32978 vulnerability poses a significant threat to users of the Quest KACE Systems Management Appliance (SMA). It allows unauthorized users to replace valid system licenses with expired or trial ones, potentially leading to system compromise or data leakage. This vulnerability affects specific versions of the appliance and could lead to a denial of service if exploited, highlighting the importance of immediate patching or implementation of temporary mitigation strategies.
Vulnerability Summary
CVE ID: CVE-2025-32978
Severity: High (7.5 CVSS score)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: System compromise, data leakage, denial of service
Affected Products
A new way to communicate
Ameeba Chat is built on encrypted identity, not personal profiles.
Message, call, share files, and coordinate with identities kept separate.
- • Encrypted identity
- • Ameeba Chat authenticates access
- • Aliases and categories
- • End-to-end encrypted chat, calls, and files
- • Secure notes for sensitive information
Private communication, rethought.
Product | Affected Versions
Quest KACE Systems Management Appliance (SMA) | 13.0.x before 13.0.385
Quest KACE Systems Management Appliance (SMA) | 13.1.x before 13.1.81
Quest KACE Systems Management Appliance (SMA) | 13.2.x before 13.2.183
Quest KACE Systems Management Appliance (SMA) | 14.0.x before 14.0.341 (Patch 5)
Quest KACE Systems Management Appliance (SMA) | 14.1.x before 14.1.101 (Patch 4)
How the Exploit Works
The exploit takes advantage of an unprotected web interface intended for license renewal. An attacker can manipulate this interface to replace valid system licenses with expired or trial ones, without needing to authenticate. This can cause a denial of service, as the system will cease to function correctly with an invalid license. It can also lead to a potential system compromise or data leakage.
Conceptual Example Code
Below is a conceptual example of how the vulnerability might be exploited using a malicious HTTP POST request.
POST /licenseRenewal HTTP/1.1
Host: target.example.com
Content-Type: application/json
{ "license_key": "EXPIRED_LICENSE_KEY" }In this example, the attacker sends a POST request with an expired license key to the “/licenseRenewal” endpoint. The server, lacking proper authentication checks, accepts the new license key, thus causing a denial of service or potential system compromise.