Exploitation of Account Connectivity Credentials in Broadcom IT Management Agent
CVE-2025-24508

6.4MEDIUM

Key Information:

Vendor

Broadcom
Status
Symantec It Management Suite
Vendor
CVE Published:
7 July 2025

What is CVE-2025-24508?

The vulnerability involves the unauthorized extraction of Account Connectivity Credentials (ACCs) from the secure storage of the IT Management Agent developed by Broadcom. This oversight can lead to severe risks, including unauthorized access to critical systems and potential data breaches. Users are advised to assess their implementations of the IT Management Agent and implement any recommended security patches or mitigations outlined by Broadcom to secure their environments.

Affected Version(s)

Symantec IT Management Suite 8.6.x, 8.7.x 8.8

References

https://support.broadcom.com/web/ecx/support-content-noti...
vendor-advisory

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-24508 : Exploitation of Account Connectivity Credentials in Broadcom IT Management Agent