The vulnerability identified as CVE-2025-62338 affects HCL BigFix Cloud Lifecycle Management versions 10.9.1 and 10.9.2. It is caused by insufficient input validation, which may result in unauthorized disclosure of sensitive information. The CVSS 3.1 base score is 3.3, indicating low severity, with an attack vector limited to local access, low attack complexity, and requiring low privileges without user interaction. No official remediation or patch information is available, and no exploits have been reported in the wild.

An attacker with local access and low privileges could exploit this vulnerability to gain unauthorized access to sensitive information. The impact is limited to confidentiality loss with no integrity or availability impact. Given the low CVSS score and lack of known exploits, the overall risk is considered low.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict local access to trusted users only and monitor for any unusual activity related to sensitive data exposure. Follow up with HCL for updates on patches or official mitigations.