The vulnerability in the BigFix Mobile Collection Manager (MCM) admin portal allows any user with internet access to reach the portal without needing a VPN or other network restrictions. An exposed client‑side configuration file reveals environment‑specific details that, while not classified as sensitive data, provide valuable information about the infrastructure setup. These disclosures enlarge the attack surface and give attackers a foothold for future unauthorized access attempts.

This issue impacts HCLSoftware’s BigFix Mobile, particularly the BigFix MCM component. No specific version constraints are listed, so all current deployments should be treated as potentially vulnerable unless an official fix has been applied.

With a CVSS base score of 6.3, the severity is moderate. The EPSS score is unavailable, indicating that the current exploitation probability is unclear, and the vulnerability is not listed in CISA’s KEV catalog. An attacker could exploit the publicly reachable admin portal to harvest environment information from the configuration file, which could be used to plan or facilitate subsequent attacks. While no immediate exploitation is confirmed, the exposed data could lower the barrier for future malicious activity.