EUVD-2025-209542
GHSA-p537-crxv-22q7
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
1DescriptionNVD
HCL BigFix Service Management (SM) Discovery is vulnerable to unenforced encryption due to port 80 (HTTP) being open, allowing unencrypted access. An attacker with access to the network traffic can sniff packets from the connection and uncover the data.
AnalysisAI
HCL BigFix Service Management Discovery accepts unencrypted HTTP traffic on port 80, allowing network-adjacent attackers to passively intercept and read sensitive data in transit without authentication or user interaction. The vulnerability exposes confidential information including credentials and system details to packet sniffing attacks on any network where the service is accessible.
Technical ContextAI
HCL BigFix Service Management (SM) is a discovery and asset management platform that typically operates over HTTPS for secure communication. This vulnerability arises from improper handling of encryption enforcement, where the application or its discovery interface listens on port 80 (HTTP) in addition to or instead of the secure port 443 (HTTPS). The root cause falls under CWE-319 (Cleartext Transmission of Sensitive Information), indicating that the service transmits sensitive data without cryptographic protection. Attackers with network visibility-such as those on the same network segment, compromised routers, or ISP-level positions-can capture and analyze unencrypted packets containing authentication tokens, configuration details, and operational data. The CPE affected is cpe:2.3:a:hclsoftware:bigfix_service_management_(sm):*:*:*:*:*:*:*:*, confirming the vulnerability spans versions of the BigFix SM product line.
RemediationAI
HCL's primary remediation is to disable HTTP (port 80) access to BigFix Service Management Discovery and enforce HTTPS (port 443) exclusively. Verify this configuration in the application settings and firewall rules. Apply any security patches released by HCL per KB article KB0127605 (https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0127605), which may include updated default configurations or enforcement mechanisms. As an interim compensating control, implement network-level restrictions to block inbound traffic to port 80 on BigFix SM servers using firewalls or security groups, permitting only authorized administrative networks. Additionally, deploy network-level encryption via VPN, SSL/TLS termination at a proxy, or network segmentation to protect data in transit even if the application continues to listen on HTTP. Monitor network traffic logs for HTTP connections to the service and investigate any sources outside approved administrative networks. Note that network-level mitigations do not eliminate the vulnerability if legitimate users or backup systems rely on HTTP access; coordinate with operations to transition fully to HTTPS before removing compensating controls.
Share
External POC / Exploit Code
Leaving vuln.today