A vulnerability has been identified in HCL BigFix Service Management (SM) due to the use of a vulnerable WSGI server component. The insecure or outdated server may expose the application to known security weaknesses, increasing the risk of exploitation and unauthorized access. This weakness falls under CWE‑200, indicating an information‑exposure vulnerability that could allow attackers to learn sensitive data or configuration details.

Affected systems are deployments of HCL BigFix Service Management (SM). No specific product versions are listed in the CNA data, so any installation that relies on the bundled WSGI server is potentially impacted. Administrators should verify the version of the WSGI server and ensure it matches any vendor‑approved secure releases.

The CVSS score of 4.6 indicates a medium severity and the EPSS score is not available, suggesting limited evidence of active exploitation. The vulnerability is not listed in the CISA KEV catalog. Because the description does not explicitly state how the weakness can be exploited, the likely attack vector is through the web interface provided by the WSGI server, potentially allowing remote actors to gain information. Because no fix or workaround is provided, the risk is primarily mitigated through updating the component and tightening access controls.