HCL BigFix Service Management (SM) Discovery allows unencrypted communication because the default HTTP port 80 is open and encryption is not enforced. This flaw enables an attacker with the ability to capture network traffic to read any data transmitted between the service and its clients, potentially including sensitive configuration or system information. The weakness falls under CWE-319: Improper Validation of Primitive Data. The impact is limited to confidentiality loss for data passing over the line, as the vulnerability does not provide direct execution or privilege escalation capabilities.

The vulnerability is specific to HCLSoftware’s BigFix Service Management (SM) product. No particular version range is listed in the available CNA data, so all revisions of the product that expose port 80 without encryption are potentially affected.

The CVSS score is 5.3, indicating a moderate risk. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires network-level access to sniff traffic; it does not require authentication or user interaction. Attackers in the same network segment or with compromised network devices could capture the data, making the issue more critical in environments with poorly segmented or insecure networks.