Executive brief
HCL BigFix Mobile is a mobile application used for enterprise device and application management. The application improperly handles error conditions and generates verbose error messages that can expose sensitive information to attackers, potentially compromising data confidentiality or revealing system details that facilitate further attacks.
Technical details
The vulnerability stems from improper exception handling and verbose error reporting in HCL BigFix Mobile. When errors occur, the application discloses detailed information through exception messages or logs that should be suppressed or redacted. An attacker can trigger error conditions over the network or through local interaction to extract sensitive data such as system paths, configuration details, or other implementation specifics. The vulnerability is classified as information disclosure (CWE-209 or similar). No authentication or special privileges are required to trigger the error conditions. A patch or security update is expected to be available from HCL.
Affected products
- HCL BigFix Mobile <UNKNOWN>
Timeline
- 2026-08-10: disclosed