Executive brief
HCL BigFix Service Management is an IT service management platform used by organizations to manage IT operations and infrastructure. A vulnerability in this application could allow attackers to extract internal IP addresses and network topology information without authentication, potentially revealing targets for further attacks on the internal network.
Technical details
This vulnerability is a sensitive information leakage issue in HCL BigFix Service Management that permits unauthenticated attackers to extract internal IP addresses from application responses. The vulnerability allows remote attackers without authentication to map the underlying network topology by analyzing application responses. The attack requires network access to the affected application but does not require user interaction. An attacker can exploit this to gather reconnaissance information about the internal network infrastructure and identify potential targets for subsequent attacks.
Affected products
- HCL BigFix Service Management
Timeline
- 2026-09-18: disclosed