HCL BigFix Service Management EUVD-2025-209701

Exploitation requires the attacker to possess valid authentication credentials (PR:L per CVSS). The victim user must interact with a malicious link or content (UI:R per CVSS), indicating that purely passive attacks or automated exploitation are not possible. The attack targets the browser's content-type sniffing behavior, which depends on the browser version and security settings - modern browsers with strict MIME-type policies may not be vulnerable. No special product configuration is required beyond the default absence of the X-Content-Type-Options header. The attack is limited to scenarios where authenticated users access BigFix SM from browsers capable of MIME sniffing (older or misconfigured user agents) and the attacker can inject or control response content.

This vulnerability presents low real-world risk despite network accessibility due to multiple limiting factors. CVSS vector shows AC:H (high attack complexity), PR:L (requires authenticated login), and UI:R (requires user interaction), collectively constraining exploitation to scenarios where a legitimate user must be socially engineered or tricked into performing a specific action. EPSS data is not provided, but the low CVSS score (3.7) and combination of authentication + user interaction requirements suggest limited automation potential. The vulnerability is categorized as information disclosure (CWE-200), not code execution, limiting the blast radius to confidentiality and availability impacts only (integrity is unaffected per CVSS I:N). No KEV listing and no public exploit code identified. The real risk depends on deployment: if BigFix SM is internet-facing and users access it from untrusted networks, risk increases; if air-gapped or internal-only, risk is minimal. Security teams should prioritize this below network-accessible RCE or pre-authentication flaws but address it during routine patching cycles.

An attacker with valid credentials to HCL BigFix Service Management crafts a specially formatted URL or injects content into a response (via stored XSS or response manipulation on a shared network) that includes executable code labeled with an ambiguous MIME type. When an authenticated user clicks the malicious link or views the injected content, the browser's MIME-sniffing behavior causes it to interpret the content as executable (e.g., JavaScript as HTML), potentially leaking sensitive information or degrading service availability. The attack requires the attacker to have prior login access and the user to interact with the malicious payload.