HCL BigFix Service Management contains an insecure communication flaw that permits an internally connected attacker to capture unencrypted HTTP traffic exchanged between backend services. The vulnerability is an instance of CWE‑319 and enables the extraction of sensitive data and possible man‑in‑the‑middle manipulation of traffic.

The affected product is HCL Software’s HCL BigFix Service Management. No specific version information is listed in the CNA data.

The CVSS score of 7.4 indicates moderate to high severity, and the EPSS score is not available. The vulnerability is not in the CISA KEV catalog. Exploitation requires internal network access and the ability to observe or interfere with traffic between backend components. An attacker could intercept credentials or configuration data and, with sufficient privileges, modify the flow of information between services. The risk is thus significant for environments where internal segmentation is weak or where BigFix Service Management communicates over plain HTTP.