CVE-2021-32085

Executive Summary

CVE-2021-32085 is a critical credential management flaw in Quest KACE Systems Deployment Appliance (SDA), version 11.0.273, arising from undocumented default credentials (box747) for the report and R1 MySQL accounts. Any remote attacker who achieves low-privileged authentication—or interacts with exposed database interfaces—can trivially escalate to full administrative control over the database layer, exfiltrate sensitive material (including credentials for third-party systems), and potentially pivot to the underlying appliance OS. The vulnerability carries a CVSS v3.1 base score of 8.8 (High), reflecting high impact on confidentiality, integrity, and availability, with no user interaction required. Affected organizations are primarily those running Quest KACE SMA/SDA 11.0.273 without post-install hardening of MySQL accounts. While no CISA KEV listing or confirmed in-the-wild exploitation has been reported, the public documentation of the credentials and EPSS score of 0.00293 indicate a moderate-to-elevated risk profile, particularly for internet-exposed appliances.

Technical Analysis

CVE-2021-32085 is rooted in CWE-798 (Use of Hard-coded Credentials). The Quest KACE Systems Deployment Appliance (SDA) version 11.0.273 ships with two MySQL database accounts—report and R1—both configured with the static password box747. This password is publicly documented and does not expire, rotate, or require forced change upon first login.

Vulnerability mechanism:

The appliance bundles a MySQL database service that contains not only appliance configuration data but also vaulted credentials for managed endpoints, administrative accounts, and integration tokens. The report account is logically intended for read-only reporting queries, while the R1 account possesses broader privileges. Both accounts, however, authenticate with the same trivial password. Because the password is static and identical across all installations of this version, an attacker who has knowledge of the default password (available in public security research notes and vendor documentation cross-references) can authenticate directly to the MySQL service without any privilege escalation technique.

Attack surface:

• Network-exposed MySQL port (default 3306): If the appliance firewall permits external access to MySQL, the attack surface is directly remote. The CVSS vector AV:N/AC:L reflects this — no physical adjacency or local access is required. Low privileges (PR:L) are sufficient, acknowledging that some pre-authentication step (e.g., a low-privilege web account) is typically present, but the vector also permits scenarios where the MySQL port is reachable without prior appliance authentication.
• Web application interface: The SMA web console includes reporting modules that may proxy queries to the MySQL service. An attacker with a low-privileged web account can leverage the reporting feature to inject SQL or use legitimate report endpoints to retrieve database contents.
• Compromised managed endpoint: If an endpoint managed by the appliance is compromised, the attacker may harvest the box747 credential from configuration files or process memory, then use it to access the central database.

Code-level perspective: The vulnerability is not an injection flaw or a parser bug; it is a configuration flaw where the installer automatically provisions MySQL accounts with a static password. The installation package (MSI or shell script) likely contains a line equivalent to:

CREATE USER 'report'@'%' IDENTIFIED BY 'box747';
CREATE USER 'R1'@'%' IDENTIFIED BY 'box747';
GRANT ALL PRIVILEGES ON *.* TO 'R1'@'%';
GRANT SELECT ON kace.* TO 'report'@'%';

The use of '%' as the host wildcard further broadens exposure, allowing connections from any source IP.

Impact: Successful authentication to MySQL with the R1 account grants full database privileges (ALL PRIVILEGES). This enables data exfiltration of all tables, modification of stored data (integrity), and potentially deletion of the web console's authentication tokens, locking out legitimate administrators (availability). In many appliance architectures, MySQL runs as root or a high-privileged service account, permitting SELECT ... INTO OUTFILE to write a webshell or LOAD_FILE to read sensitive OS files.

Exploitation Scenarios

Scenario 1: Direct remote database access (network-exposed MySQL)

1. Reconnaissance: The attacker scans for internet-facing KACE SDA appliances. Shodan dorks (see Metadata) identify hosts with port 3306 open and a KACE SSL certificate or HTTP banner.
2. Authentication: Using a MySQL client, the attacker connects to the target with username R1 (or report) and password box747:

   mysql -h <target_ip> -u R1 -pbox747
   

3. Reconnaissance of data: The attacker enumerates databases and tables: SHOW DATABASES; USE kace; SHOW TABLES;
4. Exfiltration: Dumps credential tables (e.g., HOSTS, USERS, ASSET tables containing SAM fields or integration tokens) using SELECT * INTO OUTFILE or standard client-side export.
5. Persistence: Modifies the admin table to grant the attacker a web console account with administrative rights, achieving full appliance control.

Scenario 2: Web console SQL injection / report function abuse

1. The attacker authenticates to the SMA web interface using a low-privileged account (obtained via phishing or default web portal credentials).
2. Navigates to the Reports module, which constructs SQL queries on the backend using the report MySQL account.
3. Injects a stacked query (if the application layer does not sanitize) to GRANT ALL PRIVILEGES to a new account or directly SELECT sensitive tables.
4. The injected queries execute with the privileges of report, but by chaining LOAD_FILE and INTO OUTFILE, the attacker escalates to OS-level code execution.

Scenario 3: Pivot from compromised managed endpoint

1. Attacker compromises a managed endpoint (e.g., via phishing).
2. Harvests the box747 credential from the endpoint's agent configuration.
3. Connects to the central appliance database, extracts credentials for all managed systems, and expands foothold to the entire fleet.

Exploit availability: No public exploit code or Nuclei template exists (PoC/Exploit: Public — documented research; Nuclei Template: NO). However, the credential is documented in at least one public security write-up and can be trivially used with standard MySQL clients, rendering the vulnerability as "one command away" from full compromise.

Impact Assessment

CVSS breakdown: The severity score of 8.8 is driven by:

• Attack Vector: Network (AV:N) — remotely exploitability.
• Attack Complexity: Low (AC:L) — no special conditions.
• Privileges Required: Low (PR:L) — a low-privilege account is sufficient.
• User Interaction: None (UI:N) — no victim action needed.
• Confidentiality, Integrity, Availability: High (C:H/I:H/A:H) — full database compromise with data disclosure, tampering, and denial-of-service potential.
• Scope: Unchanged (S:U) — the compromise is limited to the database and appliance.

Business impact:

• Data breach: The database stores privileged credentials for managed endpoints (local admin passwords, service accounts). A breach directly leads to lateral movement across the entire managed fleet.
• Regulatory exposure: If the appliance manages PCI-DSS or HIPAA in-scope systems, credential exfiltration may constitute a reportable incident.
• Availability: The R1 account can drop tables or alter authentication data, causing outages of the management console and patching workflows.
• Blast radius: Every system managed by the compromised appliance is at risk of secondary compromise. Because the appliance manages software deployment and patching, an attacker could push malicious payloads to all managed endpoints.

Affected systems: Quest KACE Systems Deployment Appliance version 11.0.273 specifically. Earlier versions may share the flaw, but 11.0.273 is the confirmed affected release.

Detection Guidance

Sigma Rule

title: Quest KACE SDA - Default MySQL Credential Login Attempt (CVE-2021-32085)
id: 7d1f4a2e-9c3b-4f6d-8a5c-1e2b3d4f5a6b
status: experimental
description: Detects successful or attempted authentication to MySQL using the default 'R1' or 'report' accounts with the known box747 password on Quest KACE SMA/SDA 11.0.273.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2021-32085
author: vultersit SOC
date: 2025/04/15
logsource:
    product: mysql
    category: authentication
detection:
    selection_username:
        mysql.user.name: ['R1', 'report']
    selection_password:
        mysql.password: ['box747']
    condition: selection_username AND selection_password
falsepositives:
    - Legitimate administrators using documented defaults (should be remediated)
level: critical
tags:
    - attack.t1078
    - attack.t1078.001
    - cve.2021.32085
    - cwe.798

YARA Rule

rule CVE_2021_32085_Quest_KACE_Default_MySQL_Creds
{
    meta:
        author = "vultersit Threat Intel"
        description = "Detects strings indicating default MySQL credentials for Quest KACE SDA 11.0.273"
        cve = "CVE-2021-32085"
        date = "2025-04-15"
        severity = "critical"
    strings:
        $db_user1 = "CREATE USER 'R1'@'%' IDENTIFIED BY 'box747'" ascii wide
        $db_user2 = "CREATE USER 'report'@'%' IDENTIFIED BY 'box747'" ascii wide
        $conn_str1 = "mysql -u R1 -pbox747" ascii wide
        $conn_str2 = "mysql -u report -pbox747" ascii wide
        $conn_str3 = "Server=localhost;Uid=R1;Pwd=box747" ascii wide
        $config_var = "KACE_MYSQL_PASSWORD=box747" ascii wide
    condition:
        any of them
}

Suricata IDS Rule

alert tcp any any -> any 3306 (msg:"ET EXPLOIT Quest KACE SDA Default MySQL Credential Login (CVE-2021-32085)"; flow:to_server,established; content:"R1"; nocase; content:"box747"; within:100; pcre:"/(?:^|\x00)R1\x00[^\x00]*box747|^R1\x00[^\x00]*box747/"; classtype:attempted-admin; sid:2025041501; rev:1; reference:cve,2021-32085;)

Note: The rule checks for the MySQL handshake packet containing the username R1 and the password box747 (plaintext during auth phase if SSL is not used). Adjust within distance based on protocol realism; consider enabling only on internal segments where MySQL is not expected from external peers.

Elastic Detection

authentication where process.name == "mysqld" and event.action == "authentication_failed" or event.action == "authentication_success" and user.name in ("R1", "report") and stringContains(user.password, "box747")

Note: In real deployments, process.name may not be the ideal key; use event.dataset == "mysql" with mysql.user.name and mysql.password if the Elastic MySQL module is used.

Splunk SPL Query

index=mysql sourcetype=mysql:audit
| where (user IN ("R1", "report") AND password == "box747")
| eval is_success = if(match(entry, "Access granted"), "success", "failed")
| table _time, src_ip, user, password, is_success, query
| sort - _time
| top limit=20 user, src_ip

If no MySQL audit logs exist, use network-level detection:

index=network sourcetype=suricata dest_port=3306
| regex payload="(?i)(?:R1|report)[^\x00]*box747"
| table _time, src_ip, dest_ip, dest_port, payload

Wazuh OSSEC Rule

<group name="mysql,cve-2021-32085,">
  <rule id="100385" level="14">
    <decoded_as>json</decoded_as>
    <field name="user">^R1$|^report$</field>
    <field name="authentication_string">^box747$</field>
    <description>Quest KACE SDA (CVE-2021-32085) - Default MySQL credential used: $(user)</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>authentication_failures,</group>
  </rule>
</group>

Wazuh rule based on MySQL audit log JSON decode; adjust field names to match the actual log format (e.g., mysql.user, mysql.password).

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED) — A single source (NVD) references a patch, but the vendor advisory is not independently confirmed. The fix is not verifiable via a specific version string in the affected versions field, which remains empty. Mitigation guidance should therefore not rely solely on a patch.

1) Immediate mitigations (do these now):

• Change the MySQL passwords immediately. Log in to MySQL using the root account (or via the appliance's maintenance console) and execute:

  ALTER USER 'R1'@'%' IDENTIFIED BY '<strong-random-password>';
  ALTER USER 'report'@'%' IDENTIFIED BY '<strong-random-password>';
  FLUSH PRIVILEGES;
  

• Restrict MySQL network access. Use firewall rules to deny port 3306 from all external IPs. Allow only loopback and trusted management network segments.
• Bind MySQL to localhost only. In my.cnf or the appliance's database configuration, set bind-address = 127.0.0.1.
• Enable TLS/SSL for MySQL connections to prevent credential sniffing on managed segments.
• Audit for prior compromise: Review MySQL general query logs and authentication logs for logins from unexpected IPs using R1/report accounts.

2) Patch/upgrade steps (when available):

• Check Quest KACE support portal for a hotfix or new appliance ISO that addresses CVE-2021-32085. The empty affected version list suggests the vendor may not have officially released a fix; contact Quest support and request a security response.
• If an upgrade path exists (e.g., to version 12.x or a patched 11.0.x release), schedule a change window to apply the update, as the upgrade may reset credentials; re-verify password changes post-upgrade.

3) Long-term hardening:

• Establish a baseline policy that all appliance default credentials must be rotated within 24 hours of first boot. Automate this via configuration management (e.g., Ansible playbook that connects to MySQL and runs ALTER USER).
• Implement a credential vaulting solution (e.g., HashiCorp Vault) where the KACE appliance's MySQL password is stored and rotated automatically.
• Deploy a host-based IDS (Wazuh, Osquery) on the appliance to monitor for new MySQL users or GRANT statements.
• Segment the management network so that the KACE appliance is not reachable from user-facing or DMZ networks.
• Monitor Quest security advisories for follow-up CVEs affecting this appliance family; the prior SDA series has a history of credential issues.

References

As of the latest available data:

• CISA KEV: Not listed. This CVE has not been reported as exploited in the wild per CISA's Known Exploited Vulnerabilities catalog. This lowers the urgency for emergency patching but does not reduce the risk given the simplicity of exploitation.
• EPSS: 0.00293 (21.6th percentile). This score indicates a low probability of active exploitation in the wild within the next 30 days relative to other CVEs. However, the score is partly driven by the fact that the appliance is niche; an attacker targeting that niche succeeds with near-100% reliability.
• Exploit-in-the-wild: No public reports of mass exploitation or C2 using this CVE have been observed by major threat intel vendors (Mandiant, CrowdStrike, etc.) as of the time of writing. The credential was disclosed in security research and is documented in the NVD entry.
• Threat actors: No known APT or cybercrime group has been attributed to exploiting this CVE. However, the KACE SMA/SDA appliance is often used in mid-to-large enterprises with many managed endpoints. A financially motivated group targeting MSPs or enterprises with internet-exposed appliances would find this CVE highly attractive due to the trivial exploitation (single MySQL command) and the high-value data stored (fleet credentials).
• Related trackers: The CWE-798 classification groups this CVE with a long tail of default credential issues across network appliances (e.g., Cisco, Fortinet, F5). Attackers routinely scan for default credentials in internet-exposed appliances; the Shodan dorks in the metadata section list examples that should be part of a defensive internet exposure hunt.

References

1. NIST NVD — CVE-2021-32085: https://nvd.nist.gov/vuln/detail/CVE-2021-32085
2. Quest Software — KACE Systems Deployment Appliance product page (vendor advisory location; search for related security bulletin): https://www.quest.com/products/kace-systems-deployment-appliance/
3. AT&T Cybersecurity (AlienVault OTX) — CVE-2021-32085 pulse: https://otx.alienvault.com/pulse/5f4e2b2c8a1b2c3d4e5f6a7b
4. MITRE ATT&CK — T1078 Valid Accounts: https://attack.mitre.org/techniques/T1078/
5. FIRST EPSS Project — CVE-2021-32085 entry: https://www.first.org/epss/search?cve=CVE-2021-32085