CVE-2025-24500: PAM Database Information Disclosure Flaw

CVE-2025-24500 Overview

CVE-2025-24500 is an authorization vulnerability that allows an unauthenticated attacker to access information stored in a Privileged Access Management (PAM) database. The flaw is categorized under [CWE-863] Incorrect Authorization, indicating that access control checks fail to properly restrict reads against the underlying data store. Broadcom published details in Broadcom Security Advisory #25362. An attacker on an adjacent network can reach the affected component without credentials and retrieve sensitive PAM data, including potentially privileged account material.

Critical Impact
An unauthenticated attacker with adjacent network access can read confidential data from the PAM database, exposing credentials and secrets used to protect privileged accounts.

Affected Products

Broadcom Privileged Access Manager (per Broadcom Security Advisory #25362)
Refer to the vendor advisory for affected version ranges
No additional product CPEs are published in the NVD record

Discovery Timeline

2025-01-30 - CVE-2025-24500 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24500

Vulnerability Analysis

The vulnerability resides in the authorization layer that controls access to the PAM database. The component fails to verify the caller's identity or privileges before returning data from the database. As a result, an attacker who can reach the service on an adjacent network does not need to authenticate to read records.

The NVD record classifies the issue as [CWE-863] Incorrect Authorization. This category covers cases where an access decision is made, but the rule applied is wrong or incomplete. Confidentiality, integrity, and availability impact are all rated high in the published CVSS 4.0 vector, indicating that exposed data is sensitive and may include material used to authenticate to downstream systems.

Root Cause

The root cause is missing or incorrect authorization enforcement on a code path that exposes PAM database contents. The service trusts the requester without validating that the caller possesses the privileges required to read the stored records. Broadcom's advisory is the authoritative source for the exact component and corrected behavior.

Attack Vector

Exploitation requires network reachability to the affected PAM component from an adjacent network segment. No authentication, user interaction, or special attack requirements are needed. An attacker on the same broadcast domain, VLAN, or routed adjacent subnet can issue requests that return PAM database contents. No public proof-of-concept exploit is listed in the NVD record, and the issue is not on the CISA Known Exploited Vulnerabilities catalog.

No verified exploit code has been released. See the Broadcom Security Advisory #25362 for technical details.

Detection Methods for CVE-2025-24500

Indicators of Compromise

Unexpected read requests to the PAM service originating from hosts that are not administrative consoles or known integration endpoints
Bursts of database query responses leaving the PAM server toward adjacent subnets without a preceding authenticated session
PAM application logs showing data retrieval events without a corresponding authentication or session establishment event

Detection Strategies

Audit PAM application and database logs for read operations that lack an associated authenticated principal
Correlate network flow data with PAM authentication logs to identify queries that bypass the normal login workflow
Alert on access to PAM endpoints from network segments outside the documented management plane

Monitoring Recommendations

Forward PAM, application, and database telemetry to a centralized analytics platform for retention and correlation
Baseline normal client populations and query volumes for the PAM service, then alert on deviations
Monitor egress from the PAM host for unusual outbound transfers that could indicate bulk data extraction

How to Mitigate CVE-2025-24500

Immediate Actions Required

Apply the fix described in Broadcom Security Advisory #25362 as soon as a maintenance window allows
Restrict network access to the PAM service to a dedicated management VLAN and a defined allowlist of administrative hosts
Rotate credentials, API keys, and secrets stored in the PAM database if exposure is suspected
Review PAM access logs since deployment for evidence of unauthorized reads

Patch Information

Broadcom provides remediation guidance in Broadcom Security Advisory #25362. Administrators should consult the advisory for the fixed builds that apply to their deployment and follow the vendor's upgrade procedure. The NVD record does not enumerate specific fixed version numbers, so the vendor advisory is the authoritative reference.

Workarounds

Place the PAM service behind a firewall that only permits traffic from authorized administrative networks
Disable or block external interfaces to the PAM database that are not required for operations
Require VPN or jump host access to reach the management plane, removing adjacent-network exposure where feasible

bash

# Example: restrict access to the PAM service to a management subnet
# Replace <PAM_PORT> and 10.0.10.0/24 with values for your environment
iptables -A INPUT -p tcp --dport <PAM_PORT> -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport <PAM_PORT> -j DROP