HCL BigFix Service Management (SM) contains a configuration flaw labeled “Insecure Use of Base Image Version.” The flaw allows the deployment of base images that are outdated or contain known vulnerabilities, thereby potentially exposing the application to additional security weaknesses. The vulnerability is classified as CWE‑1395, indicating improper handling of the execution environment. The impact is a configuration risk that could extend to confidentiality or integrity if the base image includes compromised software.

The affected product is HCL BigFix Service Management (SM). No specific version identifiers are listed in the CNA data, so all current installations of this product could be affected until a fix is applied or configuration changes are made.

The CVSS score of 4.0 denotes a moderate severity. The EPSS score is <1% (0.00012), indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog, suggesting no documented widespread exploitation. Based on the description, it is inferred that the likely attack vector involves using an insecure base image; an adversary who controls image selection (or an untrusted process that can modify the image) could introduce or leverage existing vulnerabilities within that image to further compromise the system.