HCL BigFix Service Management (SM) version 23 suffers from an information disclosure vulnerability (CWE-200) where server banners reveal sensitive information such as software versions and system details. This exposure can aid attackers in reconnaissance by providing details that might be used to identify and exploit other vulnerabilities. The CVSS 3.1 base score is 2.6, reflecting a low severity with attack vector as adjacent network, high attack complexity, no privileges required, and user interaction needed. The vulnerability does not affect integrity or availability.

The impact is limited to the disclosure of sensitive information through server banners. This information disclosure could facilitate attacker reconnaissance but does not directly compromise system integrity or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor vendor communications for updates. In the meantime, consider minimizing banner information exposure through configuration changes if supported by the product.