CVE-2024-38499: Broadcom Ca Client Automation Itcm

High severity, CVSS 8.8. EPSS: 0.2% chance of exploitation in the next 30 days.

CA Client Automation (ITCM) allows non-admin/non-root users to encrypt a string using CAF CLI and SD_ACMD CLI. This would allow the non admin user to access the critical encryption keys which further causes the exploitation of stored credentials. This fix doesn't allow a non-admin/non-root user to execute "caf encrypt"/"sd_acmd encrypt" commands.

Affected products

• Broadcom Ca Client Automation Itcm: version 14.5 CU7 only

Published 2024-12-17. Last modified 2026-06-17.