CVE-2025-24508 - Vulnerability Details - OpenCVE

Extraction of Account Connectivity Credentials (ACCs) from the IT Management Agent secure storage

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

No data.

No data.

No data.

References

Link	Providers
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/35904

History

Sun, 13 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00011}`	epss `{'score': 0.00015}`

Mon, 07 Jul 2025 18:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-522
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Mon, 07 Jul 2025 05:15:00 +0000

Type	Values Removed	Values Added
Description		Extraction of Account Connectivity Credentials (ACCs) from the IT Management Agent secure storage
Title		Offline Extraction of Account Connectivity Credentials (ACCs) in IT Management Suite
References		https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/35904
Metrics		cvssV3_1 `{'score': 6.4, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: symantec

Published: 2025-07-07T04:54:31.638Z

Updated: 2025-07-07T17:13:00.622Z

Reserved: 2025-01-22T08:29:34.305Z

Link: CVE-2025-24508

Vulnrichment

Updated: 2025-07-07T17:12:48.429Z

NVD

Status : Awaiting Analysis

Published: 2025-07-07T05:15:41.547

Modified: 2025-07-08T16:18:34.923

Link: CVE-2025-24508

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-24508", "assignerOrgId": "80d3bcb6-88de-48c2-a47e-aebf795f19b5", "state": "PUBLISHED", "assignerShortName": "symantec", "dateReserved": "2025-01-22T08:29:34.305Z", "datePublished": "2025-07-07T04:54:31.638Z", "dateUpdated": "2025-07-07T17:13:00.622Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "product": "Symantec IT Management Suite", "vendor": "Broadcom", "versions": [{"status": "affected", "version": "8.6.x, 8.7.x 8.8"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: transparent;\">Extraction of Account Connectivity Credentials (ACCs) from the IT Management Agent secure storage</span>"}], "value": "Extraction of Account Connectivity Credentials (ACCs) from the IT Management Agent secure storage"}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "providerMetadata": {"orgId": "80d3bcb6-88de-48c2-a47e-aebf795f19b5", "shortName": "symantec", "dateUpdated": "2025-07-07T04:54:31.638Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/35904"}], "source": {"discovery": "UNKNOWN"}, "title": "Offline Extraction of Account Connectivity Credentials (ACCs) in IT Management Suite", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-522", "lang": "en", "description": "CWE-522 Insufficiently Protected Credentials"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-07-07T17:12:56.951265Z", "id": "CVE-2025-24508", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-07T17:13:00.622Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-24508", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-07-07T17:12:56.951265Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-522", "description": "CWE-522 Insufficiently Protected Credentials"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-07T17:12:48.429Z"}}], "cna": {"title": "Offline Extraction of Account Connectivity Credentials (ACCs) in IT Management Suite", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Broadcom", "product": "Symantec IT Management Suite", "versions": [{"status": "affected", "version": "8.6.x, 8.7.x 8.8"}], "defaultStatus": "affected"}], "references": [{"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/35904", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Extraction of Account Connectivity Credentials (ACCs) from the IT Management Agent secure storage", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: transparent;\">Extraction of Account Connectivity Credentials (ACCs) from the IT Management Agent secure storage</span>", "base64": false}]}], "providerMetadata": {"orgId": "80d3bcb6-88de-48c2-a47e-aebf795f19b5", "shortName": "symantec", "dateUpdated": "2025-07-07T04:54:31.638Z"}}}, "cveMetadata": {"cveId": "CVE-2025-24508", "state": "PUBLISHED", "dateUpdated": "2025-07-07T17:13:00.622Z", "dateReserved": "2025-01-22T08:29:34.305Z", "assignerOrgId": "80d3bcb6-88de-48c2-a47e-aebf795f19b5", "datePublished": "2025-07-07T04:54:31.638Z", "assignerShortName": "symantec"}, "dataVersion": "5.1"}