CVE-2024-49814
Published: 06 February 2025
Summary
CVE-2024-49814 is a high-severity Execution with Unnecessary Privileges (CWE-250) vulnerability in Ibm Security Verify Access. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 2.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
AC-6 enforces the principle of least privilege, directly preventing execution with unnecessary privileges that enables local privilege escalation in the IBM Security Verify Access Appliance.
AC-3 requires enforcement of approved access authorizations, blocking unauthorized privilege escalations by locally authenticated users.
AC-2 manages account privileges to ensure only necessary access levels are assigned, mitigating excessive privileges exploitable for escalation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct local privilege escalation via exploitation of unnecessary privileges (CWE-250) in appliance software execution.
NVD Description
IBM Security Verify Access Appliance 10.0.0 through 10.0.3 could allow a locally authenticated user to increase their privileges due to execution with unnecessary privileges.
Deeper analysisAI
CVE-2024-49814 is a privilege escalation vulnerability in IBM Security Verify Access Appliance versions 10.0.0 through 10.0.3, stemming from execution with unnecessary privileges (CWE-250). A locally authenticated user could exploit this flaw to increase their privileges on the affected appliance. The vulnerability carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high confidentiality, integrity, and availability impacts.
The attack requires local access and low privileges (PR:L), with low attack complexity and no user interaction needed. An attacker with local authentication could leverage the unnecessary privileges during execution to elevate their access rights, potentially gaining full control over the appliance and compromising its security functions.
IBM has published an advisory detailing the issue and mitigation steps at https://www.ibm.com/support/pages/node/7182558. Security practitioners should consult this reference for patch availability and remediation guidance specific to the affected versions.
Details
- CWE(s)