CVE-2021-27780: medium-severity vulnerability in HCL BigFix Mobile / Modern Client Management
HCL BigFix Mobile / Modern Client Management is vulnerable to unauthenticated XML interaction
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
HCL BigFix Mobile/Modern Client Management allows attackers to send XML commands and enroll devices without needing to log in, potentially compromising device management and control.
The application fails to properly authenticate XML interaction endpoints and device enrollment mechanisms, enabling unauthenticated threat actors to submit malicious XML payloads and register unauthorized devices. This vector bypasses authentication controls and may lead to unauthorized device management, data exfiltration, or lateral movement within the managed environment.
In the same product, most dangerous first.