What’s Vulnerable › Vulnerabilities

CVE-2023-33254

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-05-21 · updated 2026-06-17
• Weakness: CWE-863

Description

There is an LDAP bind credentials exposure on KACE Systems Deployment and Remote Site appliances 9.0.146. The captured credentials may provide a higher privilege level on the Active Directory domain. To exploit this, an authenticated attacker edits the user-authentication settings to specify an attacker-controlled LDAP server, clicks the Test Settings button, and captures the cleartext credentials.

Affected products

• Quest Kace Systems Deployment Appliance: 9.0.146

References

• https://www.stevencampbell.info/KACE-LDAP-Bind-Credential-Exposure/
• https://www.stevencampbell.info/KACE-LDAP-Bind-Credential-Exposure/

Get alerted when CVE-2023-33254 or the next vulnerability affects your stack