CVE-2024-38499: Improper Privilege Management Vulnerability in CA Client Automation 14.5

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-12-17 · updated 2026-06-17
Weakness: CWE-269

Description

CA Client Automation (ITCM) allows non-admin/non-root users to encrypt a string using CAF CLI and SD_ACMD CLI. This would allow the non admin user to access the critical encryption keys which further causes the exploitation of stored credentials. This fix doesn't allow a non-admin/non-root user to execute "caf encrypt"/"sd_acmd encrypt" commands.

Affected products

Broadcom CA Client Automation (ITCM): 14.5 CU7

References

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25284
http://seclists.org/fulldisclosure/2024/Dec/16

Get alerted when CVE-2024-38499 or the next vulnerability affects your stack