CVE-2021-44029 is a critical remote code execution vulnerability affecting Quest KACE Desktop Authority before version 11.2. It stems from a deserialization flaw in the RadAsyncUpload function of ASP.NET AJAX, allowing unauthenticated attackers to execute arbitrary code. Exploitation requires knowledge of encryption keys, which could be obtained through other vulnerabilities like CVE-2017-11317 or CVE-2017-11357. While there is no known active exploitation or public exploit code, the vulnerability has a CVSS score of 9.8 (CRITICAL) and has garnered significant community discussion.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 10.0, < 11.2CPE matchmatch criteria | cpe:2.3:a:quest:kace_desktop_authority:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.