HCL BigFix SM CVE-2025-31973

The primary remediation is to rebuild HCL BigFix Service Management container images using current, patched base images and redeploy. HCL's advisory KB0128144 at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0128144 should be consulted for the specific updated image versions or patch packages provided by the vendor. No exact fix version was supplied in the available data, so the patch version cannot be independently confirmed - the advisory should be treated as the authoritative source. As a compensating control pending a formal upgrade, organizations can scan running container images with a container vulnerability scanner (e.g., Trivy, Grype, Anchore) to enumerate which specific CVEs are inherited from the outdated base layer, prioritizing remediation of those with network-exposed, unauthenticated attack vectors. Restricting privileged access to the containerized environment limits the local, high-privilege exploitation path described in the CVSS vector. Implementing a container image policy that blocks deployment of images with base layers older than a defined threshold (e.g., 90 days) reduces ongoing exposure. Note that updating base images requires rebuilding and redeploying the application, which may require coordination with change management processes.