CVE-2025-71260: BMC FootPrints ITSM RCE Vulnerability

CVE-2025-71260 Overview

CVE-2025-71260 is a critical insecure deserialization vulnerability affecting BMC FootPrints ITSM, a widely-used IT service management solution. The vulnerability exists in the ASP.NET servlet's VIEWSTATE handling mechanism, which fails to properly validate serialized data before deserializing it. This flaw allows authenticated attackers to supply specially crafted serialized objects to the VIEWSTATE parameter, resulting in arbitrary code execution on the affected server. Successful exploitation enables complete compromise of the application and potentially the underlying server infrastructure.

Critical Impact
Authenticated attackers can achieve remote code execution through malicious VIEWSTATE payloads, leading to full system compromise of BMC FootPrints ITSM deployments.

Affected Products

BMC FootPrints ITSM version 20.20.02
BMC FootPrints ITSM versions 20.20.03 through 20.24.01.001
All intermediate versions between 20.20.02 and 20.24.01.001

Discovery Timeline

2026-03-19 - CVE CVE-2025-71260 published to NVD
2026-03-19 - Last updated in NVD database

Technical Details for CVE-2025-71260

Vulnerability Analysis

The vulnerability resides in the ASP.NET VIEWSTATE deserialization mechanism used by BMC FootPrints ITSM. ASP.NET VIEWSTATE is designed to maintain page state across postbacks by serializing page control data into a Base64-encoded string. When the application deserializes incoming VIEWSTATE data without proper validation, it creates an opportunity for object injection attacks.

In this case, the FootPrints ITSM application fails to implement adequate protections such as VIEWSTATE MAC (Message Authentication Code) validation or encryption, allowing attackers to craft malicious serialized payloads. These payloads can leverage .NET deserialization gadget chains to execute arbitrary commands on the server with the privileges of the web application process.

The network-accessible nature of this vulnerability combined with the low attack complexity makes it particularly dangerous for organizations running vulnerable FootPrints ITSM instances exposed to untrusted networks.

Root Cause

The root cause is classified as CWE-502 (Deserialization of Untrusted Data). The ASP.NET servlet in BMC FootPrints ITSM accepts and deserializes VIEWSTATE data without sufficient integrity validation. The lack of proper MAC validation on the VIEWSTATE parameter allows attackers to inject arbitrary serialized .NET objects that execute during the deserialization process.

Attack Vector

The attack is network-based and requires authenticated access to the BMC FootPrints ITSM application. An attacker must first obtain valid credentials, then craft a malicious HTTP request containing a tampered VIEWSTATE parameter with a serialized exploitation payload. Common .NET deserialization gadgets such as TypeConfuseDelegate, TextFormattingRunProperties, or ObjectDataProvider chains can be leveraged to achieve code execution.

The exploitation workflow involves:

Authenticating to the BMC FootPrints ITSM application
Generating a malicious serialized payload using tools like ysoserial.net
Base64 encoding the payload and substituting it for the legitimate VIEWSTATE value
Submitting the crafted request to trigger deserialization and code execution

For detailed technical analysis of this vulnerability, refer to the Watchtowr Analysis on RCE Threat and the VulnCheck Advisory for BMC RCE.

Detection Methods for CVE-2025-71260

Indicators of Compromise

Abnormally large VIEWSTATE parameters in HTTP POST requests to FootPrints ITSM pages
Presence of suspicious Base64-encoded payloads containing known .NET gadget chain signatures
Unexpected child processes spawned by the IIS worker process (w3wp.exe)
Unusual command execution patterns originating from the FootPrints ITSM application server

Detection Strategies

Monitor web application logs for unusually large VIEWSTATE values or malformed requests to ASP.NET endpoints
Implement network-based detection rules to identify known .NET deserialization gadget patterns in HTTP traffic
Deploy application-level logging to capture VIEWSTATE validation failures and deserialization exceptions
Configure endpoint detection to alert on suspicious process creation chains from w3wp.exe

Monitoring Recommendations

Enable detailed IIS logging and monitor for POST requests with anomalous payload sizes to FootPrints ITSM endpoints
Implement SIEM correlation rules to detect patterns consistent with deserialization exploitation attempts
Monitor for outbound network connections from the FootPrints ITSM server to unexpected destinations
Track changes to scheduled tasks, services, and startup items on FootPrints ITSM servers

How to Mitigate CVE-2025-71260

Immediate Actions Required

Apply the appropriate hotfix for your BMC FootPrints ITSM version immediately
Restrict network access to BMC FootPrints ITSM to trusted internal networks only
Review authentication logs for any suspicious login activity prior to patching
Conduct a forensic review of FootPrints ITSM servers for signs of compromise

Patch Information

BMC has released hotfixes to remediate this vulnerability across all affected versions. Organizations should apply the hotfix corresponding to their installed version:

Version 20.20.02 - Apply hotfix 20.20.02
Version 20.20.03.x - Apply hotfix 20.20.03.002
Version 20.21.01.x - Apply hotfix 20.21.01.001
Version 20.21.02.x - Apply hotfix 20.21.02.002
Version 20.22.01.x - Apply hotfix 20.22.01 or 20.22.01.001
Version 20.23.01.x - Apply hotfix 20.23.01 or 20.23.01.002
Version 20.24.01.x - Apply hotfix 20.24.01

Refer to the BMC FootPrints 2024 Patch Notes for detailed patching instructions.

Workarounds

Implement Web Application Firewall (WAF) rules to inspect and block suspicious VIEWSTATE payloads
Enforce strict network segmentation to limit access to FootPrints ITSM servers from untrusted networks
Enable VIEWSTATE MAC validation at the IIS/ASP.NET configuration level if not enforced by the application
Consider temporarily disabling external access to FootPrints ITSM until patching is complete

bash

# IIS configuration to enforce VIEWSTATE validation
# Add to web.config in the FootPrints application directory
# <system.web>
#   <pages enableViewStateMac="true" viewStateEncryptionMode="Always" />
# </system.web>