The Most Organized Threat Actors Use Your ITSM (BMC FootPrints Pre-Auth Remote Code Execution Chains)

Sicherheitsmeldung mit Schweregrad hoch. Sie wird laut CISA-KEV aktiv ausgenutzt und sollte priorisiert behandelt werden. Betroffene Kennungen: CVE-2025-24813, CVE-2025-71257, CVE-2025-71258, CVE-2025-71259, CVE-2025-71260. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.

Originaltext der Quelle (nicht übersetzt) – die deutsche Zusammenfassung findest du im Tab „Kurzfassung".

SolarWinds. Ivanti. SysAid. ManageEngine. Giants of the KEV world, all of whom have ITSM side-projects. ITSMs, as a group of solutions, have played pivotal roles in numerous ransomware gang campaigns - not only do they represent code running on a system, but they hold a significant amount of sensitive information. With the ability to track IT inventory, configuration files, and incident reports, threat actor campaigns have never been so organized.BMC FootPrints last received a CVE in 2014. Today, we fix that. Digging into our archives, we're detailing vulnerabilities we discovered and chained in 2025 against (at the time fully patched) BMC FootPrints to achieve Pre-authenticated Remote Code Execution.Welcome back to another monologue/watchTowr Labs blogpost.What is BMC FootPrints?BMC FootPrints is an IT Service Management (ITSM) solution designed to help IT teams manage service requests, incidents, assets, and changes through configurable workflows and an intuitive web interface.Like most products in this category, it includes rollercoaster-esque excitement, such as:Ticket managementIncident trackingWorkflow automationAsset managementReportingAnd moreBMC FootPrints is one of two ITSM ‘product lines’ that BMC offers:Helix, andFootPrintsFootPrints has kept a fairly low profile, with minimal CVEs assigned to the product itself; the most recent was in 2014 (CVE-2025-24813 is for Tomcat, don't @ us). A tell?If we take that "tell", and combine it with an end-user comment we found on HackForums;“BMC Footprints has been, for the most part, solid. We have been using it for a few …

Vollständiger Originalartikel ↗

• Betroffenheit im eigenen Stack prüfen (CVE-2025-24813, CVE-2025-71257, CVE-2025-71258, CVE-2025-71259, CVE-2025-71260): Versionen/Komponenten abgleichen.
• Originalquelle / Hersteller-Advisory lesen: https://labs.watchtowr.com/thanks-itsms-threat-actors-have-never-been-so-organized-bmc-footprints-pre-auth-remote-code-execution-chains/
• Priorität HOCH: laut CISA-KEV aktiv ausgenutzt – bevorzugt patchen.
• Verfügbaren Patch oder Workaround einspielen und dokumentieren.
• Erkennung: Logs und Indikatoren (IoCs) auf Ausnutzung prüfen.