CVE-2016-1542: BMC BladeLogic RSCD agent authorization bypass enables user enumeration

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityUnauthenticated remote user enumeration with a high CVSS score, very high EPSS and public exploit code, though impact is limited to information disclosure.

What it is

The RPC API in the BMC BladeLogic Server Automation (BSA) RSCD agent on Linux and UNIX fails to enforce authorization correctly, allowing an unauthenticated remote attacker to send an action packet to xmlrpc after an authorization failure and enumerate users. Because the agent is a management component, successful enumeration exposes valid account names that can feed follow-on attacks against the same environment.

Impact

An attacker gains disclosure of valid usernames on the affected RSCD agent, which aids credential guessing, phishing and lateral movement planning. No data modification or code execution is described in the record.

Attack surface

Reachable over the network through the RSCD agent's RPC/xmlrpc interface; the CVSS vector shows no privileges required and no user interaction, so the flaw is triggered by sending a crafted action packet directly to the agent.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.746 probability, 99.5th percentile) and public exploit code exists in Exploit-DB entries 43902 and 43939, indicating practical exploitation is feasible.

What to do

• Apply the vendor patch referenced in the BMC self-service knowledge article (Patch/Vendor Advisory) to affected BSA 8.2.x through 8.7.x agents.
• Restrict network access to RSCD agent RPC/xmlrpc ports to trusted management hosts only, using firewall rules or network segmentation.
• Where the agent is not required, disable or uninstall it; otherwise run it with least privilege and avoid exposing it outside the management network.
• Monitor BMC advisories for updated agent builds and verify agent versions across Linux and UNIX hosts after patching.

Detection

• Alert on xmlrpc action packets sent to the RSCD agent that follow an authorization failure, especially repeated attempts from a single source.
• Baseline normal RSCD agent RPC traffic and flag enumeration-style request patterns or unusual source IPs contacting the agent port.
• Correlate agent-side authorization failure logs with subsequent successful or repeated RPC calls from the same source.
• Hunt for known exploit tooling or packet signatures tied to the public Exploit-DB PoCs against RSCD endpoints.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.