Quest KACE Systems Management Appliance Two-Factor Authentication Bypass Vulnerability

A logic flaw allowing authenticated users to bypass TOTP-based two-factor authentication has been identified in Quest KACE Systems Management Appliance (SMA) versions 13.0.x prior to 13.0.385, 13.1.x prior to 13.1.81, 13.2.x prior to 13.2.183, 14.0.x prior to 14.0.341 (Patch 5), and 14.1.x prior to 14.1.101 (Patch 4). This vulnerability exists in the 2FA validation process, enabling users to gain elevated access.

Impact

Exploitation of this vulnerability allows for the bypass of TOTP-based two-factor authentication, potentially leading to unauthorized access with elevated privileges.

Remediation

Quest has released patches for this vulnerability in KACE SMA versions 13.0.385, 13.1.81, 13.2.183, 14.0.341 (Patch 5), and 14.1.101 (Patch 4). Administrators are strongly encouraged to update to one of these patched versions.