Executive brief
HCL BigFix Quantum Risk Analyzer is a risk assessment and security analytics tool used by enterprises to evaluate their systems. The product contains hardcoded references to external resources and lacks binary integrity verification, allowing an attacker to either extract sensitive information or modify the application binary to inject malicious code or logic.
Technical details
The vulnerability stems from two distinct weaknesses: hardcoded external resource references (CWE-347/CWE-610) and insufficient binary integrity checks (CWE-353). The hardcoded references may expose sensitive endpoints or credentials embedded in the application, while the lack of binary integrity verification allows tampering with the executable without detection. Both issues are typically exploitable from the local attack surface or through supply-chain manipulation. An attacker could exploit these to extract configuration data, credentials, or inject unauthorized code into running instances. Patches should address resource hardcoding and implement cryptographic signature verification for binary authenticity.
Affected products
- HCL BigFix Quantum Risk Analyzer
Timeline
- 2026-08-26: disclosed