CVE-2025-32977

critical · 9.6

Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1.x before 14.1.101 (Patch 4) allows unauthenticated users to upload backup files to the system. While signature validation is implemented, weaknesses in the validation process can be exploited to upload malicious backup content that could compromise system integrity.

9.6

CVSS

0.4%

EPSS (exploit prob.)

34th

EPSS percentile

2025-06-24

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weaknesses

CWE-347

References

https://seclists.org/fulldisclosure/2025/Jun/24
https://seralys.com/research/CVE-2025-32977.txt
https://support.quest.com/kb/4379499/quest-response-to-kace-sma-vulnerabilities-cve-2025-32975-cve-2025-32976-cve-2025-32977-cve-2025-32978
http://seclists.org/fulldisclosure/2025/Jun/25

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-32977