CVE-2018-11139

This issue is like leaving a “test button” in a web page, where someone who is logged in can type special characters that turn the test into a command that the system executes. In the worst case, that means the person can control the appliance and disrupt services. For a small business, that can quickly turn into downtime and damage beyond just the email testing feature.

This matters if you use or manage Quest KACE System Management Appliance and you are running version 8.0.318.

The risk is specifically for attackers who already have an authenticated account, because the vulnerable page is accessible to any logged-in user. It becomes serious when such a user (or an attacker who has stolen credentials) can reach the KACE web interface.

This is a High-impact vulnerability (command injection) and it is reachable by any authenticated user, which makes it more dangerous than issues that require public access. The available information does not include confirmed “exploited in the wild” reporting, so the priority is still high but fits an AMBER (act soon) response.

There is also no fix/version information available from the provided patch sources, so you should treat this as an immediate containment-and-upgrade planning task rather than waiting for a known patch number.