The vulnerability lies in the use of a hard‑coded symmetric encryption key for storing secrets in the MySQL database of Quest KACE Systems Deployment Appliance (SMA). An attacker who gains read access to the database or a backup can decrypt these secrets. Once decrypted, the secrets often provide additional privileges within KACE or access to external systems, enabling credential theft or further lateral movement.

The flaw affects Quest KACE SMA version 11.0.273. No other affected versions are listed in the CVE data. The product is the Quest KACE Systems Deployment Appliance, a web‑based configuration and inventory tool.

The attack vector requires access to the MySQL server or to a backup file. With such access, the attacker can easily decrypt the stored secrets because the key is static and not unique per deployment. The CVSS score of 9.8 indicates a critical severity level, and the EPSS score is < 1% with the vulnerability not listed in CISA’s KEV catalog, indicating that exploitation frequency is low. Nonetheless, the potential impact is substantial if the required database access is achieved.