BigFix WebUI CVE-2025-15633

Exploitation requires a valid authenticated session to BigFix WebUI (PR:L per CVSS 4.0 vector); unauthenticated attackers cannot exploit this vulnerability. The attacker must hold an account that is authenticated but lacks Master Operator privileges - the flaw specifically affects the privilege tier separation within the application. Access to network-reachable BigFix WebUI endpoints is required (AV:N). No user interaction from a privileged user is needed (UI:N). SSVC 'automatable: no' suggests that scripted mass exploitation is not straightforward, likely because a per-target authenticated session must be established. Exploitation is limited to information disclosure of internal metadata (site names, versions, configuration variables); no write or destructive capability is exposed by this vulnerability.

The CVSS 4.0 score of 5.3 (Medium) is broadly consistent with the actual risk profile. The vector (AV:N/AC:L/AT:N/PR:L) confirms network-accessible exploitation requiring only a low-privileged authenticated account with no special attack timing or configuration. However, confidentiality impact is limited to the vulnerable system (VC:L) and subsequent systems (SC:L), with no integrity or availability impact. EPSS at 0.04% (12th percentile) is very low, indicating the broader security community does not currently observe active exploitation tooling. SSVC reinforces this: exploitation=none, automatable=no, technical impact=partial. The 'automatable: no' designation is notable - it implies exploitation cannot be trivially scripted at scale, likely because it requires a valid authenticated session. This is not a high-priority emergency patch but warrants attention in environments where BigFix operators have fine-grained trust boundaries, as exposed configuration metadata (site names, versions) can aid internal reconnaissance by a malicious insider or a compromised low-privilege account. No conflicts between data sources were identified.

An attacker with a valid low-privilege BigFix WebUI account - such as a contractor, help desk user, or compromised service account - directly requests internal endpoints that lack proper authorization checks, retrieving site names, installed software versions, and configuration variable values without Master Operator credentials. This metadata can be used to map the BigFix deployment topology and identify target endpoints or misconfigurations for follow-on attacks within the managed environment. No public proof-of-concept code has been identified at time of analysis.