CVE-2025-4971: Broadcom Automic Privilege Escalation Flaw

CVE-2025-4971 Overview

A privilege escalation vulnerability exists in Broadcom Automic Automation Agent for Unix systems. This vulnerability allows low-privileged users who have execution rights on the agent executable to escalate their privileges to higher access levels. The flaw is classified under CWE-426 (Untrusted Search Path), indicating that the agent executable improperly handles path resolution, potentially allowing malicious libraries or executables to be loaded from untrusted locations.

Critical Impact

Low-privileged users with execution rights on the Automic Automation Agent can achieve privilege escalation, potentially compromising system integrity and gaining unauthorized access to sensitive automation workflows and system resources.

Affected Products

• Broadcom Automic Automation Agent Unix versions prior to 24.3.0 HF4
• Broadcom Automic Automation Agent Unix versions prior to 21.0.13 HF1

Discovery Timeline

• May 20, 2025 - CVE-2025-4971 published to NVD
• May 21, 2025 - Last updated in NVD database

Technical Details for CVE-2025-4971

Vulnerability Analysis

This vulnerability stems from an untrusted search path weakness (CWE-426) in the Broadcom Automic Automation Agent for Unix platforms. The agent executable fails to properly validate or restrict the paths from which it loads dependent libraries or executables during runtime. When a low-privileged user with execution rights on the agent invokes it, the application may search for and load components from directories that the attacker can control, such as the current working directory or other writable paths in the search order.

The local attack vector requires the attacker to have an existing foothold on the target system with at least minimal execution privileges on the agent. Once exploited, the attacker can achieve high impact to confidentiality, integrity, and availability of the vulnerable system, with secondary scope effects potentially impacting connected systems in the automation environment.

Root Cause

The root cause is an untrusted search path vulnerability (CWE-426) where the Automic Automation Agent executable does not adequately secure the library or executable search paths. When the agent is executed, it may search for dependencies in an order that includes user-writable directories before trusted system directories. This allows an attacker to place a malicious library or binary in a location that will be searched first, enabling code execution with elevated privileges.

Attack Vector

The attack requires local access to a Unix system running a vulnerable version of Broadcom Automic Automation Agent. An attacker must have execution rights on the agent executable, which is a prerequisite for legitimate users who interact with the automation system. The attack proceeds as follows:

1. The attacker identifies a writable directory in the agent's search path
2. A malicious shared library or executable is placed in this directory, named to match a legitimate dependency
3. When the agent is executed, it loads the attacker-controlled component
4. Code within the malicious component runs with the privileges of the agent process, enabling privilege escalation

The exploitation requires no user interaction and has low attack complexity once initial access is achieved. For detailed technical information, refer to the Secuvera Security Advisory SA-2025-01.

Detection Methods for CVE-2025-4971

Indicators of Compromise

• Unexpected shared library files appearing in directories within the agent's execution path
• Anomalous process execution patterns associated with the Automic Automation Agent
• New or modified files in world-writable directories commonly used for library injection attacks
• Unusual child processes spawned by the agent executable with elevated privileges

Detection Strategies

• Monitor file creation and modification events in directories within the Automic Agent's library search path
• Implement application allowlisting to detect unauthorized binaries or libraries being loaded by the agent
• Deploy endpoint detection rules to identify privilege escalation attempts originating from the Automic Agent process
• Review system logs for authentication anomalies following agent execution

Monitoring Recommendations

• Enable comprehensive audit logging for the Automic Automation Agent executable and its parent directories
• Configure SentinelOne or equivalent EDR solutions to alert on process lineage anomalies involving the agent
• Monitor for unexpected changes to environment variables that could manipulate library loading behavior
• Establish baseline behavior for the Automic Agent and alert on deviations

How to Mitigate CVE-2025-4971

Immediate Actions Required

• Upgrade Broadcom Automic Automation Agent Unix to version 24.3.0 HF4 or later for the 24.x branch
• Upgrade to version 21.0.13 HF1 or later for systems running the 21.x branch
• Review and restrict file permissions on directories in the agent's execution path
• Audit user accounts with execution rights on the agent and apply principle of least privilege

Patch Information

Broadcom has released security patches to address this vulnerability. Organizations should apply the appropriate hotfix based on their installed version:

• Version 24.x: Update to 24.3.0 HF4 or later
• Version 21.x: Update to 21.0.13 HF1 or later

Detailed patch information and download links are available in the Broadcom Security Advisory 25732.

Workarounds

• Restrict execution permissions on the Automic Automation Agent to only essential administrative accounts
• Remove write permissions from all directories in the agent's library search path for non-privileged users
• Configure the agent to run with an explicit, fully-qualified path and secure LD_LIBRARY_PATH environment variable
• Implement mandatory access control policies (SELinux/AppArmor) to restrict the agent's file access patterns

# Restrict write permissions on agent installation directory
chmod -R o-w /opt/automic/agent
chown -R root:automic /opt/automic/agent

# Ensure secure library path when executing the agent
export LD_LIBRARY_PATH=/opt/automic/agent/lib

# Verify no unexpected files in agent directories
find /opt/automic/agent -type f -mtime -1 -ls