CVE-2025-31973

CriticalCVSS 9.8/10Last modified Jul 24, 2026

Description

HCL BigFix Service Management (SM) is susceptible to a Configuration – 'Insecure Use of Base Image Version'. Using outdated or insecure base images may introduce known vulnerabilities, potentially increasing the risk of exploitation in the application environment.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

VendorProductVersions
HCLBigFix Service Management (SM)23

References

Timeline

Published
May 20, 2026
Last modified
Jul 24, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-319747.2HCL BigFix Service Management (SM) is susceptible to a Root File System Not Mounted as Read-Only. An improperly configured root file system CVE-2025-319755.3HCL BigFix Service Management (SM) is affected by an Information Disclosure – Server Banner issue was identified. Exposed server banners mayCVE-2025-319767.5HCL BigFix Service Management (SM) is vulnerable to insufficiently protected credentials for a short duration while communicating with a bacCVE-2025-319776.5HCL BigFix SM is affected by cryptographic weakness due to weak or outdated encryption algorithms.  An attacker with network access could exCVE-2025-319784.3HCL BigFix Service Management (SM) does not adequately sanitize or safely render spreadsheet files (CSV, XLS, XLSX) before processing or disCVE-2025-319795.4A File Upload Validation Bypass vulnerability has been identified in the HCL BigFix SM, where the application fails to properly enforce fileCVE-2025-31985.5A vulnerability has been found in GNU Binutils 2.43/2.44 and classified as problematic. Affected by this vulnerability is the function displCVE-2025-319804.3HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker to inject unvalidatedCVE-2025-319815.3HCL BigFix Service Management (SM) Discovery is vulnerable to unenforced encryption due to port 80 (HTTP) being open, allowing unencrypted aCVE-2025-319826.5HCL BigFix Service Management (SM) had directories that were not linked or publicly visible but could be accessed directly. This could allowCVE-2025-319834.6HCL BigFix Service Management (SM) is affected by a security misconfiguration vulnerability due to CSP header. This could allow attackers tCVE-2025-319845.4HCL BigFix Service Management (SM) is affected by a security misconfiguration due to a missing or insecure “X-Content-Type-Options” header.
CVE-2025-31973: Critical severity, CVSS 9.8 | Vulnix