CVE-2024-5956: Trellix IPS Manager Auth Bypass Vulnerability

CVE-2024-5956 Overview

CVE-2024-5956 is an authentication bypass vulnerability in Trellix Intrusion Prevention System (IPS) Manager. Unauthenticated remote attackers can bypass authentication controls and gain partial data access to the management interface. The response returned to the attacker consists mostly of garbage data, limiting the practical scope of information disclosure.

The issue is tracked under CWE-287 (Improper Authentication) and CWE-305 (Authentication Bypass by Primary Weakness). Trellix documented the flaw in a public knowledge base article.

Critical Impact
Remote, unauthenticated attackers can bypass authentication on the IPS Manager over the network without user interaction, resulting in limited confidentiality impact to a security-critical appliance.

Affected Products

Trellix Intrusion Prevention System Manager
Trellix IPS Manager version 11.1.7.97
Deployments exposing the IPS Manager web interface to untrusted networks

Discovery Timeline

2024-09-05 - CVE-2024-5956 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-5956

Vulnerability Analysis

The vulnerability resides in the authentication layer of the Trellix IPS Manager, a centralized console used to configure and monitor Trellix intrusion prevention sensors. An attacker who can reach the management interface over the network can send requests that circumvent the authentication check and receive responses from protected endpoints.

According to the vendor description, the returned data is largely unstructured or garbled, which reduces the direct value of any single response. Repeated probing, however, can still expose fragments of application data or metadata useful for reconnaissance against the security appliance itself.

The attack requires no privileges and no user interaction. Integrity and availability are not directly affected, and impact is scoped to the vulnerable component rather than the wider system.

Root Cause

The root cause is improper authentication enforcement on server-side request handling within the IPS Manager. Mapped to CWE-287 and CWE-305, the flaw indicates that an authentication primary check can be bypassed, allowing requests to reach protected code paths without a valid session.

Attack Vector

Exploitation is performed remotely over the network against the IPS Manager service. An attacker sends crafted HTTP requests to management endpoints that should require authentication. The server processes the request and returns partial data instead of rejecting the call. The EPSS score is approximately 0.389% at the 32.462 percentile, indicating a low observed exploitation probability. No public proof-of-concept, exploit code, or CISA KEV listing is currently associated with this CVE. Technical details are documented in the Trellix Article Overview.

Detection Methods for CVE-2024-5956

Indicators of Compromise

Unauthenticated HTTP or HTTPS requests to Trellix IPS Manager endpoints that return 200 OK responses without a preceding successful login flow.
Repeated requests from a single source to management URLs with no associated session cookie or authentication header.
Responses containing binary or malformed payloads returned to unauthenticated clients.

Detection Strategies

Inspect IPS Manager web access logs for requests to protected paths lacking valid session tokens.
Correlate management-plane traffic with expected administrator source addresses to surface anomalous clients.
Alert on scanning patterns targeting the IPS Manager port range from non-administrative network segments.

Monitoring Recommendations

Forward IPS Manager application and access logs to a central SIEM for long-term retention and correlation.
Baseline normal administrator activity and alert on deviations in source IP, user agent, or request volume.
Monitor for outbound data flows from the IPS Manager host that do not match expected update or telemetry destinations.

How to Mitigate CVE-2024-5956

Immediate Actions Required

Restrict network access to the Trellix IPS Manager management interface to trusted administrative subnets only.
Place the IPS Manager behind a VPN or jump host and remove any direct internet exposure.
Review recent access logs for unauthenticated requests that received non-error responses.

Patch Information

Trellix has published guidance in the Trellix Article Overview. Administrators should apply the fixed release identified in that advisory to versions at or below 11.1.7.97. Confirm the installed build after upgrade and validate that management endpoints reject unauthenticated requests.

Workarounds

Enforce network-layer access control lists that restrict the management port to a small set of administrative hosts.
Terminate management traffic through a reverse proxy that requires client certificate authentication.
Disable or firewall off any management interface exposed on untrusted network segments until patching is complete.

bash

# Example: restrict inbound access to Trellix IPS Manager to an admin subnet
iptables -A INPUT -p tcp --dport 443 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP