HCL BigFix Service Management (SM) Discovery component in version 23 exposes sensitive information over an unencrypted HTTP connection on port 80. Because encryption is not enforced, network attackers can intercept and read sensitive data transmitted between clients and the service. The CVSS 3.1 base score is 5.3 (medium severity) reflecting network attack vector, low complexity, no privileges or user interaction required, and limited confidentiality impact. No official fix or mitigation guidance is currently available from HCLSoftware.

An attacker with access to the network traffic can capture unencrypted packets transmitted over HTTP and obtain sensitive information. The confidentiality of data is impacted, but integrity and availability are not affected. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to disable HTTP access on port 80 and enforce HTTPS to ensure encryption of data in transit. Network segmentation or use of VPNs to restrict access to the service may reduce exposure.