CVE-2025-71260: BMC FootPrints ITSM 20.20.02 <= 20.24.01.001 VIEWSTATE Deserialization RCE
BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a deserialization of untrusted data vulnerability in the ASP.NET servlet's VIEWSTATE handling that allows authenticated attackers to execute arbitrary code. Attackers can supply crafted serialized objects to the VIEWSTATE parameter to achieve remote code execution and fully compromise the application. The following hotfixes remediate the vulnerability: 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
BMC FootPrints ITSMto a version that resolves this vulnerability.Fixed in 20.20.02 - Upgrade
Upgrade
BMC FootPrints ITSMto a version that resolves this vulnerability.Fixed in 20.20.03.002 - Upgrade
Upgrade
BMC FootPrints ITSMto a version that resolves this vulnerability.Fixed in 20.21.01.001 - Upgrade
Upgrade
BMC FootPrints ITSMto a version that resolves this vulnerability.Fixed in 20.21.02.002 - Upgrade
Upgrade
BMC FootPrints ITSMto a version that resolves this vulnerability.Fixed in 20.22.01 - Upgrade
Upgrade
BMC FootPrints ITSMto a version that resolves this vulnerability.Fixed in 20.22.01.001 - Upgrade
Upgrade
BMC FootPrints ITSMto a version that resolves this vulnerability.Fixed in 20.23.01 - Upgrade
Upgrade
BMC FootPrints ITSMto a version that resolves this vulnerability.Fixed in 20.23.01.002
Event History
Frequently Asked Questions
What is the severity of CVE-2025-71260?
CVE-2025-71260 is considered a critical vulnerability as it allows authenticated attackers to execute arbitrary code remotely.
How do I fix CVE-2025-71260?
To fix CVE-2025-71260, upgrade BMC FootPrints ITSM to a version later than 20.24.01.001.
Who is affected by CVE-2025-71260?
CVE-2025-71260 affects BMC FootPrints ITSM versions from 20.20.02 to 20.24.01.001.
What type of vulnerability is CVE-2025-71260?
CVE-2025-71260 is a deserialization of untrusted data vulnerability in the VIEWSTATE handling of ASP.NET.
Can CVE-2025-71260 be exploited remotely?
Yes, CVE-2025-71260 can be exploited remotely by authenticated attackers to execute arbitrary code.