Bigfix Service Management
CVE-2025-31972
MEDIUM
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
HCL BigFix SM is affected by a Sensitive Information Exposure vulnerability where internal connections do not use TLS encryption which could allow an attacker unauthorized access to sensitive data transmitted between internal components.
AnalysisAI
HCL BigFix SM is affected by a Sensitive Information Exposure vulnerability where internal connections do not use TLS encryption which could allow an attacker unauthorized access to sensitive data. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified under CWE-319. HCL BigFix SM is affected by a Sensitive Information Exposure vulnerability where internal connections do not use TLS encryption which could allow an attacker unauthorized access to sensitive data transmitted between internal components. Affected products include: Hcltech Bigfix Service Management.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
More in Bigfix Service Management
View allHCL BigFix Service Management (SM) ships container deployments built on outdated or insecure base images, inheriting kno
Missing X-Content-Type-Options response header in HCL BigFix Service Management (SM) leaves browsers without MIME-type s
HCL BigFix SM is affected by cryptographic weakness due to weak or outdated encryption algorithms. Rated medium severity
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today