Quest KACE Systems Deployment Appliance (SMA) version 11.0.273 implements rate‑limiting on certain API endpoints to reduce brute‑force authentication attempts. The limiter relies on a cookie named kboxid; if an attacker removes or fails to send this cookie, the rate‑limiting is disabled. Based on the description, it is inferred that the attacker can manipulate the cookie via direct HTTP request modification. Consequently, an adversary can send an unlimited number of requests, thereby bypassing the authentication guard and potentially gaining unauthorized access to management functions, although the flaw does not provide direct code execution.

The only affected product is Quest KACE Systems Deployment Appliance (SMA) 11.0.273. No other vendors or product versions are listed as impacted.

Based on the description, it is inferred that the attack vector is remote via HTTP API; the exploit merely requires the ability to send HTTP requests and manipulate cookie data. Because the exploit requires only the ability to send requests and manipulate the cookie, any host that can reach the appliance’s API can attack. The CVSS score of 9.8 reflects the high impact of the authentication bypass, while the EPSS score of < 1 % indicates a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. An attacker could rapidly delete the kboxid cookie and flood the endpoint, effectively nullifying the rate‑limiting defense and enabling brute‑force credential attempts.