CVE-2014-125113
Critical
Description
An unrestricted file upload vulnerability exists in Dell (acquired by Quest) KACE K1000 System Management Appliance version 5.0 - 5.3, 5.4 prior to 5.4.76849, and 5.5 prior to 5.5.90547 in the download_agent.php endpoint. An attacker can upload arbitrary PHP files to a temporary web-accessible directory, which are later executed through inclusion in backend code that loads files under attacker-controlled paths.
SeverityCritical
CVSS9.3
Exploit probability—
ProductKACE K1000 Systems Management Appliance
PublishedAug 5, 2025
First seenAug 5, 2025
How to fix
Update
- Dell/Quest KACE K1000 Systems Management Appliance5.4.76849, 5.5.90547 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Dell/Quest KACE K1000 Systems Management Appliance | 5.0 ≤ v ≤ 5.3, 5.4 ≤ v < 5.4.76849, 5.5 ≤ v < 5.5.90547 | 5.4.76849, 5.5.90547 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.