CVE-2024-4844

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-05-16 · updated 2026-06-17
Weakness: CWE-798

Description

Hardcoded credentials vulnerability in Trellix ePolicy Orchestrator (ePO) on Premise prior to 5.10 Service Pack 1 Update 2 allows an attacker with admin privileges on the ePO server to read the contents of the orion.keystore file, allowing them to access the ePO database encryption key. This was possible through using a hard coded password for the keystore. Access Control restrictions on the file mean this would not be exploitable unless the user is the system admin for the server that ePO is running on.

Affected products

Trellix Epolicy Orchestrator: epo_5.10_service_pack_1_update_2

References

https://thrive.trellix.com/s/article/000013505
https://thrive.trellix.com/s/article/000013505

Get alerted when CVE-2024-4844 or the next vulnerability affects your stack