HCL BigFix SM CVE-2025-31973

Local access is required - this is not a remotely exploitable vulnerability per the AV:L CVSS vector. The attacker must already hold high privileges (PR:H) on the system or container environment. User interaction (UI:R) is also required, meaning the attack cannot be automated without a cooperating user action. The exploitable condition is the presence of unpatched vulnerabilities within the container base image layers that HCL BigFix SM is built upon. Exploitation is therefore constrained to: (1) an insider or already-compromised privileged account, (2) operating locally on the host or within the container runtime, and (3) leveraging a specific vulnerability in the inherited base image - the precise CVEs of which depend on which base image version is in use. Remote, unauthenticated exploitation is not consistent with this advisory's CVSS vector.

The CVSS base score of 4.0 (Medium) is consistent with the vector breakdown: local attack vector (AV:L), low complexity (AC:L), high privileges required (PR:H), user interaction required (UI:R), unchanged scope (S:U), and low confidentiality, integrity, and availability impact (C:L/I:L/A:L). This combination substantially limits real-world risk - an attacker would need to already operate with high privileges on the local system and require user interaction to achieve only partial impact. No EPSS score was provided in the source data, so exploitation probability cannot be quantified. KEV status is negative (not listed), and no POC has been identified. The tag 'Information Disclosure' partially conflicts with the vector's balanced low C/I/A impact, suggesting the primary concern may lean toward confidentiality. The most realistic risk scenario is not direct exploitation of this CVE but rather lateral exposure through inherited vulnerabilities in the base image - a risk multiplier rather than a standalone critical flaw. Overall, this is a low-urgency, hygiene-class finding that warrants remediation during normal patch cycles rather than emergency response.

A local administrator or privileged user with existing elevated access to the HCL BigFix SM environment interacts with the containerized application in a way that triggers a vulnerability inherited from the outdated base image - for example, exploiting a known CVE in a bundled system library. The attacker leverages the inherited flaw to read sensitive configuration data or make limited modifications within the container's unchanged scope. No public exploit code targeting this specific advisory has been identified at the time of analysis.