CVE-2024-4844: Trellix ePO Hardcoded Credentials Vulnerability

CVE-2024-4844 Overview

CVE-2024-4844 is a hardcoded credentials vulnerability in Trellix ePolicy Orchestrator (ePO) on Premise prior to version 5.10 Service Pack 1 Update 2. The flaw resides in the orion.keystore file, which is protected by a hardcoded password. An attacker with administrative privileges on the ePO server can read the keystore and retrieve the ePO database encryption key. File system access control restrictions limit exploitation to users who are already the system administrator of the host running ePO. The vulnerability is categorized under CWE-798: Use of Hard-coded Credentials.

Critical Impact
An administrator on the ePO server host can extract the database encryption key from orion.keystore, exposing sensitive data stored in the ePO database.

Affected Products

Trellix ePolicy Orchestrator (ePO) on Premise prior to 5.10 Service Pack 1 Update 2
ePO deployments where the orion.keystore file is accessible to server system administrators
On-premise installations of the ePO management console

Discovery Timeline

2024-05-16 - CVE-2024-4844 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-4844

Vulnerability Analysis

Trellix ePolicy Orchestrator uses a Java keystore file, orion.keystore, to store the encryption key for the ePO database. The keystore is protected by a static password compiled into the product rather than a per-installation secret. An attacker who reads the keystore file and knows or recovers the hardcoded password can extract the database encryption key. With the encryption key in hand, the attacker can decrypt sensitive material stored in the ePO database, including credentials and configuration data used to manage endpoint agents across the enterprise.

Exploitation requires prior administrative access to the underlying ePO server host, which raises attack complexity. However, the impact is significant because the ePO database centralizes management data for a large endpoint estate.

Root Cause

The root cause is the use of a static, product-wide password to protect the orion.keystore file. Because the credential is embedded in the product rather than generated per install, any attacker who can read the keystore can also unlock it. This pattern is tracked as CWE-798: Use of Hard-coded Credentials.

Attack Vector

The attacker must first hold administrative privileges on the server hosting ePO. From that position, the attacker reads orion.keystore from disk and uses the hardcoded password to unlock the keystore. The attacker then exports the ePO database encryption key and uses it to decrypt data at rest in the ePO database. No verified proof-of-concept code is published for this issue. See the Trellix Article 000013505 for vendor technical detail.

Detection Methods for CVE-2024-4844

Indicators of Compromise

Unexpected read access to the orion.keystore file on the ePO server
Copies of orion.keystore observed outside the ePO installation directory or on removable media
Unusual database queries or bulk exports from the ePO database performed outside standard maintenance windows
Administrative logon events on the ePO server host that do not correlate to scheduled operator activity

Detection Strategies

Enable file access auditing on the ePO installation directory and alert on reads of orion.keystore by any process other than the ePO service account
Correlate interactive administrator logons on the ePO server with subsequent file access on keystore and configuration files
Baseline expected process access to Java keystore files and flag deviations

Monitoring Recommendations

Forward Windows Security and Sysmon events from the ePO server to a central log platform for retention and analysis
Monitor for outbound transfers of files matching keystore signatures from ePO servers
Review privileged access management logs for administrator sessions on the ePO host

How to Mitigate CVE-2024-4844

Immediate Actions Required

Upgrade Trellix ePolicy Orchestrator on Premise to 5.10 Service Pack 1 Update 2 or later
Restrict interactive and remote administrator access to the ePO server to a small, audited set of operators
Apply least privilege on the orion.keystore file so only the ePO service account can read it
Rotate credentials and secrets stored in the ePO database after patching if compromise is suspected

Patch Information

Trellix addresses the issue in ePO on Premise 5.10 Service Pack 1 Update 2. Refer to Trellix Article 000013505 for patch availability and upgrade procedure. Confirm the ePO build number after upgrade to validate the fix is applied.

Workarounds

Enforce host-level access control so that only vetted personnel hold administrator rights on the ePO server
Store ePO servers in a hardened management network segment with jump host access only
Enable file integrity monitoring on orion.keystore and adjacent configuration files to detect unauthorized reads or copies

bash

# Configuration example
# Restrict access to the ePO keystore on Windows (run as Administrator)
# Replace <ePOServiceAccount> with the account that runs the ePO service
icacls "C:\Program Files (x86)\McAfee\ePolicy Orchestrator\Server\conf\orion\orion.keystore" /inheritance:r
icacls "C:\Program Files (x86)\McAfee\ePolicy Orchestrator\Server\conf\orion\orion.keystore" /grant:r "<ePOServiceAccount>:(R)"
icacls "C:\Program Files (x86)\McAfee\ePolicy Orchestrator\Server\conf\orion\orion.keystore" /grant:r "Administrators:(R)"