CVE-2024-45636: IBM QRadar EDR Plaintext Credential Storage (3.12–3.12.24)

Technical summary

CVE-2024-45636 affects IBM Security QRadar EDR 3.12.0 through 3.12.24 and stems from improper credential handling (CWE-256, CWE-522). The application stores authentication credentials in cleartext within accessible file system locations rather than using encryption or secure credential management APIs. An authenticated local user with administrative or system-level privileges can enumerate the affected files and extract plaintext credentials, bypassing authentication controls. The CVSS 3.1 vector (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N) reflects the high barrier to exploitation: local access requirement, high privileges prerequisite, and attack complexity factors, offset by high confidentiality impact.

Business impact

Credential exposure in QRadar EDR undermines the integrity of your security infrastructure. An insider or compromised privileged account holder can extract credentials to impersonate legitimate users, access sensitive analytics, or pivot to monitored endpoints and systems. In regulated environments (financial, healthcare, government), plaintext credential storage often violates compliance mandates (PCI-DSS, HIPAA, SOC 2). Recovery requires credential rotation across dependent systems and forensic investigation to identify unauthorized access.

Affected systems

IBM Security QRadar EDR 3.12 through 3.12.24 are affected. Verify your installed version in the QRadar administration console. The vulnerability requires local system access, so air-gapped or strictly network-isolated QRadar instances face lower risk. However, any environment permitting local shell or SSH access by privileged users (including system administrators and service accounts) should be treated as at-risk.

Exploitability

Exploitation is not trivial and does not appear in active public exploits (KEV status: not listed). An attacker must already possess elevated local privileges on the QRadar system—a significant hurdle that limits opportunistic exploitation. However, insider threats, supply-chain compromises, or privilege escalation chains could lower the practical barrier. The high attack complexity and privilege requirement reduce spontaneous exploitation likelihood, but the simplicity of the attack itself (reading files) once privileges are obtained makes this a credible lateral-movement vector.

Remediation

Upgrade IBM Security QRadar EDR to a patched version beyond 3.12.24. Consult the IBM Security advisory for the minimum safe version. Until patched, enforce strict file-system and process-level access controls restricting privileged user accounts to minimum-necessary privileges, use filesystem encryption (LUKS, dm-crypt on Linux or BitLocker on Windows) for QRadar installation directories, monitor file access logs for suspicious reads of credential storage locations, and enforce SSH key-based authentication with disabled password logins where possible.

Patch guidance

IBM has released patches to address plaintext credential storage. Contact IBM Security support or check the official QRadar security advisories to identify the patched version for your deployment track. Plan testing in a non-production environment before rolling out. If immediate patching is not feasible, layer compensating controls: restrict SSH and local console access, implement OS-level file access logging and alerting, and rotate all QRadar and dependent system credentials as a defensive measure.

Detection guidance

Monitor for unusual access patterns to QRadar configuration and credential files (typically in /opt/qradar or equivalent Windows paths). Enable file integrity monitoring (AIDE, osquery) to alert on unauthorized reads of sensitive configuration files. Correlate privileged user login sessions with subsequent suspicious file reads. Implement process-level auditing to capture which user contexts attempt to access stored credentials. Log analysis should flag any unexpected tool execution (cat, grep, base64 decoding utilities) by privileged users targeting config directories.

Why prioritize this

Although the CVSS score is MEDIUM (4.1) due to high exploitation barriers, credential exposure is a business-critical threat in a security analytics platform. QRadar EDR typically integrates with your wider detection ecosystem; compromised credentials can cascade to network isolation or forensics bypass. The attack requires existing high privilege, limiting widespread risk, but should be prioritized for organizations with insider-threat programs, multi-tenant environments, or strict regulatory compliance requirements. Organizations with strong privilege separation and filesystem monitoring can defer patching slightly; those without should accelerate remediation.

Risk score, explained

The CVSS 3.1 score of 4.1 (MEDIUM) reflects: Attack Vector Local (AV:L) — requires system-level access; Attack Complexity High (AC:H) — practical exploitation requires privilege and file system knowledge; Privilege Required High (PR:H) — attacker must already be an authenticated privileged user; User Interaction None (UI:N) — no social engineering required; Confidentiality High (C:H) — plaintext credentials fully exposed; Integrity None (I:N) and Availability None (A:N) — no direct data modification or service disruption. The score underweights insider threat and supply-chain risk scenarios, so context-dependent escalation is reasonable for sensitive environments.

Frequently asked questions