Executive brief
BMC FootPrints is an IT Service Management platform used to manage service requests, incidents, and assets. A flaw in how the application deserializes untrusted data in the VIEWSTATE parameter allows authenticated attackers to execute arbitrary code on the server, fully compromising the application and potentially enabling access to sensitive IT inventory and configuration data stored within.
Technical details
The vulnerability exists in the ASP.NET servlet's VIEWSTATE handling within BMC FootPrints versions 20.20.02 through 20.24.01.001. An authenticated attacker can supply crafted serialized objects (via the AspectJWeaver gadget chain or similar deserialization gadgets) to the VIEWSTATE parameter to trigger unsafe deserialization, leading to remote code execution. The attack requires authentication but allows complete application compromise. BMC released hotfixes in September 2025 for all affected versions (20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01). This vulnerability is part of a chain with authentication bypass (CVE-2025-71257) discovered by watchTowr Labs.
Affected products
- BMC FootPrints ITSM 20.20.02 through 20.24.01.001
Timeline
- 2025-06-06: disclosed: watchTowr Labs disclosed CVE-2025-71260 (WT-2025-0072) to BMC
- 2025-09-02: patched: BMC released hotfixes for all affected versions
- 2026-03-02: advisory: CVE-2025-71260 assigned
- 2026-03-18: other: watchTowr Labs published detailed research