TLDR Tech / InfoSec
The Most Organized Threat Actors Use Your ITSM (BMC FootPrints Pre-Auth Remote Code Execution Chains)
watchTowr chained four flaws in BMC FootPrints — an auth bypass (CVE-2025-71257), two SSRF bugs (CVE-2025-71258, CVE-2025-71259), and a Java deserialization RCE (CVE-2025-71260) — to achieve pre-authenticated remote code execution on fully patched versions 20.20.02 through 20.24.01.001. The auth bypass leaks a session token via the password-reset endpoint, which then unlocks the SSRF and deserialization chains. BMC shipped hotfixes in September 2025 after a three-month back-and-forth reproduction process. CVEs were only assigned in March. FootPrints had no CVEs since 2014, making it an under-scrutinized target sitting on networks that also hold IT asset inventories and incident data.
Read the full story