High severity · published May 6, 2026
CVE-2024-30151
HCL BigFix Service Management (SM) is susceptible to Broken Access Control Vulnerability
8.3
CVSS
0.2%
EPSS
No
On KEV
Description
HCL BigFix Service Management (SX) is affected by a Broken Access Control vulnerability leading to privilege escalation. This could allow unauthorized users to gain elevated privileges, bypassing intended access restrictions. This may result in exposure of sensitive data or unauthorized system modifications
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BS
BigFix Service Management (SM) · HCL
23 · source: vendor
BS
Bigfix Service Management · Hcltech
23.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-30151
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-30151
Vendor Advisory
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0127782
More from BigFix Service Management (SM)
9.8
CVE-2025-31973
HCL BigFix Service Management (SM) is susceptible to a Configuration – 'Insecure Use of Base Image Version'
8.8
CVE-2025-52613
HCL BigFix Service Management (SM) is affected by use of a vulnerable component
6.5
CVE-2025-31985
HCL BigFix Service Management (SM) is affected by a security misconfiguration due to a missing or insecure “X-Content-Type-Options” header
5.4
CVE-2025-31984
HCL BigFix Service Management (SM) is affected by a security misconfiguration due to a missing or insecure “X-Content-Type-Options” header
5.3
CVE-2025-31960
HCL BigFix Service Management (SM) is vulnerable to information exposure due to improper error handling within its reporting module