What is the CVSS score of CVE-2025-31958?

CVE-2025-31958 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of BigFix Service Management are affected by CVE-2025-31958?

HCL BigFix Service Management (SM) 23 contains a high-severity HTTP request smuggling vulnerability (CVE-2025-31958) that, under specific deployment configurations, could allow attackers to bypass…

How to fix or mitigate CVE-2025-31958?

Within 24 hours, inventory all HCL BigFix Service Management (SM) 23 instances and determine which are deployed behind front-end HTTP servers or proxies; verify that front-end and back-end request parsing configurations are consistent and restrict network access to trusted sources. Within 7 days, implement interim mitigations such as deploying a web application firewall (WAF) with request smuggling detection, enabling detailed HTTP traffic logging, and monitoring for anomalies; contact HCL support to obtain a patch timeline. Within 30 days, apply the vendor-released patch as soon as it is available, or migrate to a supported version with the fix; conduct a security review of proxy configurations to ensure consistent parsing and consider network segmentation to limit exposure.

BigFix Service Management CVE-2025-31958

EUVD-2025-209541 HIGH

HTTP Request/Response Smuggling (CWE-444)

2026-04-21 HCL

GHSA-f8cq-gr3x-x7xf

Authentication Bypass Request Smuggling Bigfix Service Management Sm Hclsoftware

8.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

vuln.today AI

6.5 MEDIUM

Unauthenticated network attack (AV:N/PR:N), but AC:H because it depends on a front-end/back-end parsing desync that varies per deployment; integrity-dominant (I:H) with limited disclosure (C:L).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Sep 30, 2026 - 22:49 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Sep 30, 2026 - 22:23 vuln.today

cvss_changed

Severity Changed

Sep 30, 2026 - 22:23 NVD

LOW HIGH

CVSS changed

Sep 30, 2026 - 22:23 NVD

3.7 (LOW) 8.2 (HIGH)

Analysis Generated

Apr 21, 2026 - 16:31 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 14:30 euvd

EUVD-2025-209541

Analysis Generated

Apr 21, 2026 - 14:30 vuln.today

CVE Published

Apr 21, 2026 - 13:59 nvd

LOW 3.7

DescriptionNVD

HCL BigFix Service Management is susceptible to HTTP Request Smuggling. HTTP request smuggling vulnerabilities arise when websites route HTTP requests through web servers with inconsistent HTTP parsing. HTTP Smuggling exploits inconsistencies in request parsing between front-end and back-end servers, allowing attackers to bypass security controls and perform attacks like cache poisoning or request hijacking.

AnalysisAI

HTTP request smuggling in HCL BigFix Service Management (SM) 23 allows unauthenticated remote attackers to bypass front-end security controls, poison caches, or hijack requests when the product is deployed behind a front-end HTTP server or proxy that parses requests differently than the back-end. Exploitation requires this specific desynchronized topology (high complexity per independent assessment), and no public exploit or active exploitation has been identified; EPSS is 0.03% (8th percentile), indicating very low likelihood of exploitation at this time.

Technical ContextAI

This is a CWE-444 (Inconsistent Interpretation of HTTP Requests) vulnerability. It arises when HTTP requests pass through a front-end proxy or load balancer and a back-end server that disagree on how to delimit request boundaries-typically due to ambiguous handling of Content-Length and Transfer-Encoding headers. An attacker can craft a request that is parsed as two separate requests by the back-end but as one by the front-end (or vice versa), enabling request smuggling. The CPE string cpe:2.3:a:hclsoftware:bigfix_service_management_(sm):*:*:*:*:*:*:*:* confirms the affected component is HCL BigFix Service Management (SM). Per EUVD, version 23 is affected. The CVSS vector shows network attack (AV:N), no privileges (PR:N), no user interaction (UI:N), but the independent assessment adjusts attack complexity to High (AC:H) because the flaw only manifests when the proxy and back-end parsing differ-a condition not present in all deployments.

RemediationAI

Apply the latest updates for HCL BigFix Service Management (SM) 23 as directed by the vendor advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124209; a patch is available per vendor advisory, though no exact fix version is specified in the available data. Because exploitation requires a front-end/back-end parsing mismatch, ensure that any intermediary (reverse proxy, load balancer, WAF) is configured to parse requests consistently with the back-end-e.g., reject requests with both Content-Length and Transfer-Encoding headers, or use HTTP/2 end-to-end. Trade-off: strict normalization may break legacy clients that send ambiguous headers. If patching is not immediately possible, isolating the BigFix SM v23 instance so it is not exposed through an intermediary with different parsing rules reduces risk to effectively zero for this vulnerability.