CVE-2024-41775: IBM Cognos Controller Vulnerability

CVE-2024-41775 Overview

CVE-2024-41775 affects IBM Cognos Controller versions 11.0.0 and 11.0.1. The product uses weaker than expected cryptographic algorithms, classified as Use of a Broken or Risky Cryptographic Algorithm [CWE-327]. An attacker positioned to intercept encrypted traffic or access protected data could decrypt highly sensitive financial and corporate performance information processed by the application.

IBM Cognos Controller is widely deployed for financial consolidation, close, and reporting workflows. Compromise of its cryptographic protections directly exposes regulated financial data.

Critical Impact
A network-based attacker with no authentication or user interaction can decrypt sensitive data protected by the affected cryptographic routines in IBM Cognos Controller.

Affected Products

IBM Cognos Controller 11.0.0
IBM Cognos Controller 11.0.1
CPE: cpe:2.3:a:ibm:cognos_controller:11.0.0 and 11.0.1

Discovery Timeline

2024-12-03 - CVE-2024-41775 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-41775

Vulnerability Analysis

The vulnerability resides in cryptographic routines used by IBM Cognos Controller 11.0.0 and 11.0.1. The product relies on algorithms or parameters that no longer meet modern security expectations. This category, tracked as [CWE-327], includes use of deprecated ciphers, short key lengths, weak modes of operation, or insecure hashing primitives.

When sensitive data is encrypted using these weakened primitives, an attacker with access to ciphertext can recover plaintext with substantially less effort than a secure algorithm would require. The attack vector is network-based and requires no privileges or user interaction.

The exposed data includes financial records, consolidation entries, user credentials, and configuration secrets managed by the Controller application. Confidentiality is fully impacted, while integrity and availability are not directly affected.

Root Cause

The root cause is reliance on cryptographic algorithms or configurations that fall below current industry baselines. Common patterns in this CWE class include use of DES, 3DES, RC4, MD5, SHA-1, ECB mode block ciphers, or RSA with insufficient key lengths. IBM has not published algorithm-level detail in the public advisory.

Attack Vector

An attacker captures encrypted material, either by intercepting network traffic, accessing stored ciphertext, or reading exported configuration. The attacker then performs cryptanalysis against the weak algorithm offline. Successful decryption returns plaintext credentials, financial data, or session material that can be used in follow-on attacks against the Cognos Controller environment.

No authenticated session or user interaction is required to exploit the cryptographic weakness once ciphertext is in the attacker's possession.

Detection Methods for CVE-2024-41775

Indicators of Compromise

Unexpected outbound connections from Cognos Controller hosts to untrusted networks where ciphertext could be exfiltrated.
Network captures showing TLS or application-layer sessions negotiated with deprecated ciphers such as RC4, 3DES, or export-grade suites.
Audit log entries indicating bulk export of encrypted configuration, user, or financial data.

Detection Strategies

Inspect Cognos Controller server traffic for legacy cipher negotiation using passive TLS monitoring and flag any non-AES-GCM or non-ChaCha20 sessions.
Run version inventory queries against installed IBM Cognos Controller deployments to identify hosts at 11.0.0 or 11.0.1.
Correlate authentication failures and data export events across Controller, Active Directory, and database logs to surface credential reuse following potential decryption.

Monitoring Recommendations

Forward Cognos Controller application, IIS, and Windows event logs to a centralized SIEM for retention and analytics.
Monitor file integrity on Controller configuration directories that hold encrypted secrets and keystores.
Alert on administrative actions that read, copy, or export encrypted blobs from the Controller database.

How to Mitigate CVE-2024-41775

Immediate Actions Required

Apply the fix referenced in the IBM Support advisory for CVE-2024-41775 to all instances of Cognos Controller 11.0.0 and 11.0.1.
Rotate all credentials, service accounts, and integration secrets that were previously stored or transmitted by affected Controller installations.
Restrict network access to Cognos Controller servers to known administrative and application subnets only.

Patch Information

IBM has published remediation guidance on the IBM Support Page. Administrators should review the advisory, apply the vendor-supplied interim fix or upgraded build for IBM Cognos Controller 11.0.x, and confirm post-installation that affected components report the patched version.

Workarounds

Place Cognos Controller behind a reverse proxy or load balancer that enforces TLS 1.2 or 1.3 with modern cipher suites until the patch is applied.
Disable legacy protocol and cipher support at the operating system level using Windows Schannel registry settings or equivalent host configuration.
Limit administrative and integration accounts that can export encrypted Controller data, and enforce multi-factor authentication on those accounts.

bash

# Example: disable weak ciphers on Windows hosts running Cognos Controller
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 128/128" /v Enabled /t REG_DWORD /d 0 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\Triple DES 168" /v Enabled /t REG_DWORD /d 0 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server" /v Enabled /t REG_DWORD /d 0 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server" /v Enabled /t REG_DWORD /d 0 /f