HCL BigFix RunBookAI EUVD-2025-209670

High-privilege user authentication is required (PR:H in CVSS vector) - attacker must possess valid administrative credentials for HCL BigFix RunBookAI or compromise an admin account beforehand. The vulnerable component must be accessible over the network (AV:N), typically the web UI or API endpoint for runbook/automation management. No user interaction is required (UI:N); the attacker only needs to submit input and observe the unprotected response. The exploitation is not specific to a particular deployment mode or non-default configuration - the weakness exists in the component's default implementation. Limitations: exploitation is confined to information disclosure (C:L) with no integrity impact (I:N) or availability impact (A:N), reducing blast radius compared to code-execution vulnerabilities. Authentication requirement drastically restricts attack surface compared to CVEs requiring PR:N.

CVSS 2.7 (low) with network attack vector may understate real-world risk due to access control constraints. The metric PR:H (high privilege required) significantly limits exploitation scope - only authenticated administrators can trigger the vulnerability, which reduces opportunistic exploitation likelihood. EPSS data not provided, but CWE-522 combined with information disclosure tagging suggests the primary risk is credential exposure or configuration data leakage within trusted-admin scenarios rather than remote code execution or lateral movement. The lack of KEV listing and absence of public exploit indicators suggest this is not yet actively exploited in the wild. However, the continued existence ('Continued availability') language implies this is a known weakness that HCL has not fully remediated in 11.2. For organizations running BigFix RunBookAI as administrative infrastructure, even low-CVSS information disclosure requires mitigation because compromised credentials could lead to automation-engine-level compromise. Risk priority depends on deployment architecture: isolated administrative networks reduce threat; internet-facing instances or hybrid cloud increase exposure.

An authenticated administrator of HCL BigFix RunBookAI, either legitimate user whose account is compromised or insider threat, accesses the vulnerable text input component (e.g., runbook creation UI, API credential field, or configuration panel). The weak input handling fails to mask or encrypt the input as it is processed, allowing the attacker to read plaintext credentials, API keys, or operational secrets from the request/response or logs. The attacker exports these credentials and uses them to compromise downstream systems managed by BigFix RunBookAI.