An unauthenticated user enumeration vulnerability in TCMAN GIM exposes system user information, facilitating targeted credential attacks.

This vulnerability occurs in the /WS/PDAWebService.asmx endpoint, where an unauthenticated attacker can leverage the pda:username parameter within a GetUserQuestionAndAnswer SOAP action to verify valid user accounts.

The ability for an unauthenticated actor to perform user enumeration significantly lowers the barrier for subsequent brute-force or credential-stuffing attacks. With a CVSS score of 7.5, this flaw represents a high risk as it facilitates reconnaissance, potentially leading to unauthorized account access and broader system compromise.

Immediate Action: Update the TCMAN GIM software to version 20250401 or later to resolve the vulnerability.

Proactive Monitoring: Review web access logs for anomalous patterns of SOAP requests directed at /WS/PDAWebService.asmx, particularly those repeatedly targeting the GetUserQuestionAndAnswer action.

Compensating Controls: Implement rate limiting or blocking on the vulnerable endpoint via a Web Application Firewall to restrict unauthorized enumeration attempts until the patch can be applied.

Public Exploit Available: No (exploit_available: unknown)

Organizations utilizing TCMAN GIM must prioritize the upgrade to version 20250401. User enumeration is a foundational step in the attack lifecycle, and mitigating this vulnerability is essential to preventing more severe unauthorized access scenarios.