CVE-2024-45643 Overview
CVE-2024-45643 affects IBM Security QRadar EDR 3.12, which uses weaker than expected cryptographic algorithms. An attacker can exploit this weakness to decrypt sensitive credential information stored or transmitted by the product. The flaw is classified under CWE-327, Use of a Broken or Risky Cryptographic Algorithm. IBM has published guidance through the IBM Support Page.
Critical Impact
Attackers can decrypt sensitive credentials protected by weak cryptographic algorithms, leading to confidentiality loss across the QRadar EDR deployment.
Affected Products
- IBM Security QRadar EDR 3.12
- Linux kernel-based deployments hosting QRadar EDR
- Environments storing credentials encrypted by the affected QRadar EDR build
Discovery Timeline
- 2025-03-14 - CVE-2024-45643 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-45643
Vulnerability Analysis
The vulnerability resides in the cryptographic protection layer of IBM Security QRadar EDR 3.12. The product uses cryptographic algorithms that no longer meet modern strength requirements. These weak algorithms protect credential material handled by the EDR platform. An attacker with access to the encrypted data can apply known cryptanalytic techniques to recover plaintext credentials.
The issue is network-accessible and requires no authentication or user interaction. Successful exploitation impacts confidentiality without affecting integrity or availability. The EPSS probability reported for this issue is 0.202%.
Root Cause
The root cause is the selection and use of cryptographic primitives that fall below current strength expectations. [CWE-327] describes this class of weakness, where developers rely on algorithms with known weaknesses or insufficient key strength. In QRadar EDR 3.12, this choice exposes credential material that should be cryptographically opaque to an attacker.
Attack Vector
An attacker on the network who can observe or obtain encrypted credential data can attempt decryption offline. The attack does not require privileges on the QRadar EDR host. Once credentials are recovered, the attacker can authenticate to integrated systems or pivot deeper into the monitored environment. Refer to the IBM Support Page for vendor-specific exploitation context.
No public proof-of-concept code is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2024-45643
Indicators of Compromise
- Unexpected outbound connections from QRadar EDR appliances to untrusted hosts that may indicate credential exfiltration attempts.
- Authentication events on integrated systems using QRadar service accounts from unusual source addresses or at unusual times.
- Access to QRadar EDR configuration files or database backups by accounts that do not normally interact with them.
Detection Strategies
- Audit cryptographic configuration of the QRadar EDR deployment against the fixed version referenced by IBM.
- Monitor for anomalous reads of credential stores, configuration exports, or backup files on the QRadar host.
- Correlate QRadar service account authentication events across integrated data sources to identify replay or misuse.
Monitoring Recommendations
- Enable verbose audit logging on the QRadar EDR appliance and forward logs to a centralized analytics platform.
- Track integration credential usage and rotate any credentials suspected of exposure.
- Alert on configuration file access outside scheduled maintenance windows.
How to Mitigate CVE-2024-45643
Immediate Actions Required
- Apply the IBM-provided fix referenced on the IBM Support Page for QRadar EDR 3.12.
- Rotate all credentials configured within QRadar EDR, including integration accounts and API tokens.
- Restrict network access to the QRadar EDR management interfaces to trusted administrative subnets.
Patch Information
IBM published remediation guidance for QRadar EDR 3.12 on the vendor advisory page. Administrators should follow the upgrade steps documented in the IBM Support Page and confirm the build number after patching. Validate that credential storage now uses the updated cryptographic primitives.
Workarounds
- Limit exposure of the QRadar EDR appliance to management networks until the patch is applied.
- Re-encrypt or rotate stored credentials after upgrading to the fixed release.
- Monitor integrated systems for use of credentials that existed prior to remediation and revoke them once replaced.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
