CVE-2024-4844 - CVE House
Back to Database
Status published High CVE-2024-4844

Hardcoded credentials vulnerability in Trellix ePolicy Orchestrator (ePO) on Premise...

Vulnerability Description

Hardcoded credentials vulnerability in Trellix ePolicy Orchestrator (ePO) on Premise prior to 5.10 Service Pack 1 Update 2 allows an attacker with admin privileges on the ePO server to read the contents of the orion.keystore file, allowing them to access the ePO database encryption key. This was possible through using a hard coded password for the keystore. Access Control restrictions on the file mean this would not be exploitable unless the user is the system admin for the server that ePO is running on.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-4844

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • David Mayer from Neuvik

References

More from Trellix

View All →
CVE-2025-7958
A Code Injection vulnerability existed in Trellix Network Security CM...
High 7.1
CVE-2025-5967
A stored cross-site scripting vulnerability in ENS HX 10.0.4 allows...
Medium 5.3
CVE-2025-3773
A sensitive information exposure vulnerability in System Information Reporter...
Unknown 0
CVE-2025-3771
A path or symbolic link manipulation vulnerability in SIR 1.0.3...
High 7.2
CVE-2025-3722
A path traversal vulnerability in System Information Reporter (SIR) 1.0.3...
Unknown 0

Affected Vendor

Affected Software

ePolicy Orchestrator
Vulnerable Versions:
All versions below ePO 5.10 Service Pack 1 Update 2

Timeline

Official Publish: May 16th, 2024
Last Modified: August 1st, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-798

MITRE ATT&CK TTPs

T1552 Unsecured Credentials
Credential Access
T1078 Valid Accounts
Persistence
T1021 Remote Services
Lateral Movement
T1190 Exploit Public-Facing Application
Initial Access
T1098 Account Manipulation
Privilege Escalation