CVE-2025-31951

HighCVSS 8.8/10Last modified Oct 7, 2026

Description

HCL BigFix RunBookAI is affected by a Unvalidated Command Input / Potential Command Smuggling vulnerability. A flaw in a component's input handling was identified that could permit unauthorized command execution.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77 CWE-351 CWE-451

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: May 6, 2026
Last modified: Oct 7, 2026
NVD status: Awaiting Analysis

Related CVEs from 2025

CVE-2025-319527.1HCL iAutomate is affected by an insufficient session expiration. This allows tokens to remain valid indefinitely unless manually revoked, i CVE-2025-319536.5HCL iAutomate includes hardcoded credentials which may result in potential exposure of confidential data if intercepted or accessed by unaut CVE-2025-319544.3HCL iAutomate v6.5.1 and v6.5.2 is susceptible to a sensitive information disclosure. An HTTP GET method is used to process a request and i CVE-2025-319556.5HCL iAutomate is affected by a sensitive data exposure vulnerability. This issue may allow unauthorized access to sensitive information wit CVE-2025-319575.7HHCL BigFix Service Management (SM) is affected by a Cross‑Site Request Forgery (CSRF) vulnerability. This could lead to unauthorized chang CVE-2025-319588.2HCL BigFix Service Management is susceptible to HTTP Request Smuggling. HTTP request smuggling vulnerabilities arise when websites route HT CVE-2025-319593.5HCL BigFix Service Management (SM) application fails to strip EXIF metadata from uploaded images. This could lead to confidentiality and pr CVE-2025-31965.5A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. Affected is the function Assimp::MD2 CVE-2025-319605.3HCL BigFix Service Management (SM) is vulnerable to information exposure due to improper error handling within its reporting module. It was CVE-2025-319614.6HCL Connections contains a broken access control vulnerability that may allow unauthorized user to update data in certain scenarios.CVE-2025-319624.3Insufficient session expiration in the Web UI authentication component in HCL BigFix IVR version 4.2 allows an authenticated attacker to gai CVE-2025-319633.3Improper authentication and missing CSRF protection in the local setup interface component in HCL BigFix IVR version 4.2 allows a local atta