{"id":"CVE-2018-11138","published":"2018-05-31T18:29:00Z","modified":"2026-08-13T05:17:15Z","title":"Quest KACE System Management Appliance Remote Command Execution Vulnerability","vendor":"Quest","product":"KACE System Management Appliance","tier":"core","eol":null,"description":{"text":"The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by anonymous users and can be abused to execute arbitrary commands on the system.","provenance":"source","from":"NVD"},"summary":{"text":"The Quest KACE System Management Appliance contains a flaw in its '/common/download_agent_installer.php' script, which is reachable by anonymous users and is affected in version 8.0.318. An attacker with network access can abuse this script, requiring no authentication, no user interaction, and no special configuration, to execute arbitrary operating system commands on the appliance.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:45Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.91719,"percentile":0.99814,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2022-03-25","dueDate":"2022-04-15","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-11138","provenance":"source"},"vulncheckKev":{"dateAdded":"2019-06-13","exploitedFirstSeen":"2019-06-13","ransomware":true,"evidence":[{"url":"https://www.akamai.com/blog/security/latest-echobot-26-infection-vectors","date":"2019-06-13"},{"url":"https://www.researchgate.net/publication/348602660_An_analysis_of_the_use_of_CVEs_by_IoT_malware","date":"2020-12-01"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-03-25"}],"evidenceTotal":3,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"https://www.coresecurity.com/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities","tags":["Exploit","Technical Description","Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/44950/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.coresecurity.com/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities","tags":["Exploit","Technical Description","Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/44950/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-11138","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: unauthenticated remote web endpoint exploitation","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"is accessible by anonymous users","start":104,"end":136}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: arbitrary OS command execution","mappingType":"primary_impact","evidence":[{"from":"description","quote":"can be abused to execute arbitrary commands on the system","start":141,"end":198}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2018-3180","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-3180","exploited":true,"exploitedSince":"2022-03-25","provenance":"source"},"exploits":[{"id":44950,"url":"https://www.exploit-db.com/exploits/44950","title":"Quest KACE Systems Management - Command Injection (Metasploit)","type":"remote","platform":"unix","date":"2018-06-27","verified":true,"provenance":"source"},{"id":44950,"url":"https://www.exploit-db.com/exploits/44950","title":"Quest KACE Systems Management - Command Injection (Metasploit)","type":"remote","platform":"unix","date":"2018-06-27","verified":true,"provenance":"source"},{"id":44950,"url":"https://www.exploit-db.com/exploits/44950","title":"Quest KACE Systems Management - Command Injection (Metasploit)","type":"remote","platform":"unix","date":"2018-06-27","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":3,"earliest":"2018-06-27"},"metasploit":[{"name":"Quest KACE Systems Management Command Injection","module":"exploit/unix/http/quest_kace_systems_management_rce","type":"exploit","disclosureDate":"2018-05-31","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/http/quest_kace_systems_management_rce.rb"}],"nuclei":[{"id":"CVE-2018-11138","name":"Quest KACE System Management Appliance 8.0.318 - Remote Code Execution","severity":"critical","path":"http/cves/2018/CVE-2018-11138.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-11138.yaml"}],"first":{"date":"2018-05-31","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/http/quest_kace_systems_management_rce.rb"},"provenance":"source"},"exploitRefs":["https://www.coresecurity.com/advisories/quest-kace-system-management-appliance-multiple-vulnerabilities","https://www.exploit-db.com/exploits/44950/"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2018-05-31","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-11138","provenance":"source"},{"date":"2018-05-31","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2018-06-27","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/http/quest_kace_systems_management_rce.rb","provenance":"source"},{"date":"2019-06-13","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.akamai.com/blog/security/latest-echobot-26-infection-vectors","provenance":"source"},{"date":"2022-03-25","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-03-25","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-3180","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"Metasploit","daysToKev":1394},"priority":{"score":79.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2695 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.96,"detail":"percentile 0.9981"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 NVD references tagged Exploit; 3 Exploit-DB entries; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}