Improper Input Validation in PAM Logs for Broadcom Products
CVE-2025-24501

5.3MEDIUM

Key Information:

Vendor: Broadcom
Status: Symantec Privileged Access Management
Vendor: CVE Published:; 30 January 2025

What is CVE-2025-24501?

An improper input validation vulnerability exists in Broadcom's PAM product, allowing unauthenticated attackers to manipulate PAM logs by sending specifically crafted HTTP requests. This can lead to unauthorized access and integrity issues within the logging framework of vulnerable systems.

Affected Version(s)

Symantec Privileged Access Management 3.4.6

Symantec Privileged Access Management 4.1.0 <= 4.1.8

References

https://support.broadcom.com/web/ecx/support-content-noti...

CVSS V4

Score:

5.3

Severity:

MEDIUM

Confidentiality:

None

Integrity:

Low

Availability:

None

Attack Vector:

Adjacent Network

Attack Complexity:

Low

Attack Required:

None

Privileges Required:

Undefined

User Interaction:

None

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jan 30, 2025
Vulnerability Reserved
Jan 22, 2025

Credit

Stefan Grönke ([email protected])