HCL BigFix Mobile / Modern Client Management is vulnerable to unauthenticated XML interaction

HCL BigFix Mobile/Modern Client Management allows attackers to send XML commands and enroll devices without needing to log in, potentially compromising device management and control.

The application fails to properly authenticate XML interaction endpoints and device enrollment mechanisms, enabling unauthenticated threat actors to submit malicious XML payloads and register unauthorized devices. This vector bypasses authentication controls and may lead to unauthorized device management, data exfiltration, or lateral movement within the managed environment.