Bigfix Quantum Risk Analyzer
Monthly
HCL BigFix Quantum Risk Analyzer contains a hardcoded external resource reference combined with absent binary integrity verification, exposing the product to binary substitution attacks and potential sensitive information disclosure. The affected CPE covers all versions of the product under hclsoftware. A locally privileged attacker could exploit the missing integrity check (CWE-494) to substitute a malicious binary fetched from the hardcoded external reference, achieving high-integrity impact. No public exploit code exists and CISA KEV does not list this vulnerability at time of analysis.
HCL BigFix Quantum Risk Analyzer leaks internal system details through overly verbose error messages returned during input validation, enabling attackers with local high-privileged access to conduct more efficient reconnaissance against the platform. By submitting malformed inputs and observing descriptive error responses, an adversary can map internal validation logic and fine-tune automated fuzzing tools to generate valid payloads for follow-on exploitation. No public exploit code exists and no active exploitation is confirmed (not listed in CISA KEV); with CVSS 3.9 and a vector requiring local high-privilege access with high complexity, real-world risk is low and confined to already-privileged insiders or post-compromise actors.
HCL BigFix Quantum Risk Analyzer contains a hardcoded external resource reference combined with absent binary integrity verification, exposing the product to binary substitution attacks and potential sensitive information disclosure. The affected CPE covers all versions of the product under hclsoftware. A locally privileged attacker could exploit the missing integrity check (CWE-494) to substitute a malicious binary fetched from the hardcoded external reference, achieving high-integrity impact. No public exploit code exists and CISA KEV does not list this vulnerability at time of analysis.
HCL BigFix Quantum Risk Analyzer leaks internal system details through overly verbose error messages returned during input validation, enabling attackers with local high-privileged access to conduct more efficient reconnaissance against the platform. By submitting malformed inputs and observing descriptive error responses, an adversary can map internal validation logic and fine-tune automated fuzzing tools to generate valid payloads for follow-on exploitation. No public exploit code exists and no active exploitation is confirmed (not listed in CISA KEV); with CVSS 3.9 and a vector requiring local high-privilege access with high complexity, real-world risk is low and confined to already-privileged insiders or post-compromise actors.