---
cve: "CVE-2025-71260"
severity: "HIGH"
cvss: 8.7
epss: "34.4%"
vendor: "BMC Software, Inc."
kev: false
exploited: false
published: "2026-03-19 14:16:13"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-11-01T09:12:56+01:00"
---

# CVE-2025-71260

> 8.7 HIGH

## Beschreibung

BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a deserialization of untrusted data vulnerability in the ASP.NET servlet's VIEWSTATE handling that allows authenticated attackers to execute arbitrary code. Attackers can supply crafted serialized objects to the VIEWSTATE parameter to achieve remote code execution and fully compromise the application. The following hotfixes remediate the vulnerability: 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01.

## CNA-Record (Kanon, cvelistV5)

- CNA: **VulnCheck**
- State: PUBLISHED
- Stand: 2026-08-14 16:49:35
- CNA-CVSS: **8.7** (`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **poc**
  - Automatable: **no**
  - Technical Impact: **total**

## CVSS-Vektor

```
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Gering | warn |
| UI Interaktion | Keine | bad |

## Schwachstellen-Klasse

- **CWE-502** — Deserialization of Untrusted Data
  The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

## Angriffsmuster (CAPEC)

- [CAPEC-586 — Object Injection](https://capec.mitre.org/data/definitions/586.html) _(Severity: High)_

## Referenzen

- <https://docs.bmc.com/xwiki/bin/view/More-Products/Footprints/FootPrints/fp2024/Release-notes/2024-Release-01-Patch-2/>
- <https://labs.watchtowr.com/thanks-itsms-threat-actors-have-never-been-so-organized-bmc-footprints-pre-auth-remote-code-execution-chains/>
- <https://www.vulncheck.com/advisories/bmc-footprints-itsm-viewstate-deserialization-rce>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2025-71260/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_