CVE-2025-71257: BMC FootPrints ITSM Auth Bypass Flaw

CVE-2025-71257 Overview

CVE-2025-71257 is an authentication bypass vulnerability affecting BMC FootPrints ITSM, a widely deployed IT service management solution used by organizations to manage help desk operations and IT infrastructure. The vulnerability exists due to improper enforcement of security filters on restricted REST API endpoints and servlets within the application. This flaw allows unauthenticated remote attackers to bypass access controls, invoke restricted functionality, and gain unauthorized access to sensitive application data while potentially modifying system resources.

The vulnerability is classified as CWE-306 (Missing Authentication for Critical Function), indicating that critical functionality lacks proper authentication checks. Organizations running vulnerable versions of BMC FootPrints ITSM should prioritize patching to prevent unauthorized access to their IT service management infrastructure.

Critical Impact

Unauthenticated remote attackers can bypass access controls to invoke restricted REST API endpoints and servlets, potentially gaining unauthorized access to application data and modifying system resources without authentication.

Affected Products

• BMC FootPrints ITSM version 20.20.02
• BMC FootPrints ITSM versions through 20.24.01.001
• BMC FootPrints ITSM versions 20.21.x, 20.22.x, and 20.23.x prior to hotfix application

Discovery Timeline

• 2026-03-19 - CVE CVE-2025-71257 published to NVD
• 2026-03-19 - Last updated in NVD database

Technical Details for CVE-2025-71257

Vulnerability Analysis

This authentication bypass vulnerability stems from inadequate security controls on the application's REST API layer. BMC FootPrints ITSM implements security filters to restrict access to sensitive API endpoints and servlets; however, the enforcement mechanism contains flaws that allow attackers to circumvent these restrictions entirely.

The vulnerability enables unauthenticated access to restricted functionality that should require proper authentication. Successful exploitation can lead to unauthorized data access across the ITSM platform, including potentially sensitive service tickets, user information, and system configuration data. Additionally, attackers may be able to modify system resources, potentially impacting the integrity and availability of the IT service management platform.

Research from WatchTowr Labs has documented how threat actors have targeted ITSM solutions like BMC FootPrints, demonstrating the real-world interest in exploiting such vulnerabilities within enterprise environments.

Root Cause

The root cause is improper enforcement of security filters on restricted REST API endpoints and servlets within BMC FootPrints ITSM. The application fails to properly authenticate requests to certain critical endpoints, allowing unauthenticated attackers to access functionality that should be protected. This represents a CWE-306 (Missing Authentication for Critical Function) weakness where authentication checks are either missing or can be bypassed for sensitive operations.

Attack Vector

The attack vector for CVE-2025-71257 is network-based, requiring no authentication and no user interaction. Attackers can remotely target exposed BMC FootPrints ITSM installations by crafting requests to the vulnerable REST API endpoints and servlets.

The exploitation flow typically involves:

1. An attacker identifies an exposed BMC FootPrints ITSM instance running a vulnerable version
2. The attacker sends specially crafted requests to restricted API endpoints or servlets
3. Due to improper security filter enforcement, the requests bypass authentication checks
4. The attacker gains unauthorized access to application data and potentially modifies system resources

No verified proof-of-concept code is publicly available. For technical implementation details, refer to the VulnCheck BMC FootPrints Advisory and the WatchTowr Analysis.

Detection Methods for CVE-2025-71257

Indicators of Compromise

• Unusual or unexpected access to REST API endpoints without valid authentication sessions
• Unauthenticated requests to sensitive servlets or administrative API endpoints
• Anomalous data access patterns or modifications to system resources without corresponding authenticated user activity
• Log entries showing successful API calls from sources without prior authentication events

Detection Strategies

• Monitor web server and application logs for unauthenticated requests to restricted REST API endpoints
• Implement web application firewall (WAF) rules to detect and block suspicious request patterns targeting BMC FootPrints API endpoints
• Deploy network intrusion detection systems (NIDS) with signatures for BMC FootPrints ITSM exploitation attempts
• Audit authentication logs for gaps between API activity and authenticated sessions

Monitoring Recommendations

• Enable verbose logging on BMC FootPrints ITSM to capture all API requests and authentication events
• Implement alerting for high-volume or unusual API access patterns from unauthenticated sources
• Regularly review access logs for signs of reconnaissance or exploitation attempts
• Consider deploying an endpoint detection and response (EDR) solution on servers hosting BMC FootPrints ITSM

How to Mitigate CVE-2025-71257

Immediate Actions Required

• Apply the appropriate BMC hotfix for your version immediately to remediate the vulnerability
• Restrict network access to BMC FootPrints ITSM instances to trusted networks and users only
• Review access logs for any signs of unauthorized access or exploitation attempts
• Implement additional authentication controls at the network layer while awaiting patch deployment

Patch Information

BMC has released hotfixes to remediate this vulnerability. Organizations should apply the appropriate hotfix based on their current version:

Refer to the BMC FootPrints 2024 Patch Notes for detailed patching instructions.

Workarounds

• Restrict access to BMC FootPrints ITSM to trusted internal networks using firewall rules or network segmentation
• Implement a reverse proxy with additional authentication requirements in front of the BMC FootPrints application
• Deploy a web application firewall (WAF) configured to block unauthenticated requests to sensitive REST API endpoints
• Consider temporarily disabling external access to the application until patches can be applied

# Example: Restrict access to BMC FootPrints ITSM using iptables
# Allow only trusted subnet to access the application
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP