HCL BigFix Platform stores private cryptographic keys on Windows hosts with overly permissive file system permissions. This allows any local user or process with read access to the key files to obtain the keys, enabling the attacker to decrypt protected data, impersonate the system, or sign certificates. The vulnerability is a classic example of improper ACL configuration (CWE-276, CWE-732) and poses a direct threat to the confidentiality and integrity of the platform.

The affected product is the HCLSoftware BigFix Platform. No specific version information is provided, so all deployments of the platform should be evaluated for the presence of this permission issue.

The CVSS score of 8.8 indicates a high severity vulnerability. EPSS information is not available, so the likelihood of exploitation cannot be quantified based on current data. The vulnerability is not listed in CISA’s KEV catalog, suggesting no known active exploitation. The likely attack vector is a local user or a compromised process on the Windows host being able to read the key files; an attacker with remote access that can execute code on the host could also leverage the permissive permissions. This is inferred from the description of insecure permissions on private keys.