CVE-2025-32977

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-32977
Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.x before 14.1.101 (Patch 4) allows unauthenticated users to upload backup files to the system. While signature validation is implemented, weaknesses in the validation process can be exploited to upload malicious backup content that could compromise system integrity.

9.6 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://seclists.org/fulldisclosure/2025/Jun/24
https://seralys.com/research/CVE-2025-32977.txt
https://support.quest.com/kb/4379499/quest-response-to-kace-sma-vulnerabilities-cve-2025-32975-cve-2025-32976-cve-2025-32977-cve-2025-32978
Configurations

No configuration.

History

26 Jun 2025, 18:58

Type Values Removed Values Added
Summary
  • (es) Quest KACE Systems Management Appliance (SMA) 13.0.x (anterior a la 13.0.385), 13.1.x (anterior a la 13.1.81), 13.2.x (anterior a la 13.2.183), 14.0.x (anterior a la 14.0.341 [Parche 5]) y 14.1.x (anterior a la 14.1.101 [Parche 4]) permiten a usuarios no autenticados cargar archivos de copia de seguridad al sistema. Aunque se implementa la validación de firmas, las vulnerabilidades en el proceso de validación pueden explotarse para cargar contenido de copia de seguridad malicioso que podría comprometer la integridad del sistema.

24 Jun 2025, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-06-24 15:15

Updated : 2025-06-26 18:58

NVD link : CVE-2025-32977

Mitre link : CVE-2025-32977

CVE.ORG link : CVE-2025-32977

JSON object : View

Products Affected

No product.

CWE
CWE-347

Improper Verification of Cryptographic Signature