What is the CVSS score of CVE-2025-31975?

CVE-2025-31975 has a CVSS 3.1 base score of 2.6 (Low). CVSS vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

HCL BigFix Service Management CVE-2025-31975

EUVD-2025-209690 LOW

Information Exposure (CWE-200)

2026-05-06 HCL

GHSA-mp4f-c4m3-gxr6

Information Disclosure Bigfix Service Management Sm

2.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

2.6 LOW

AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 15:01 vuln.today

DescriptionCVE.org

HCL BigFix Service Management (SM) is affected by an Information Disclosure - Server Banner issue was identified. Exposed server banners may reveal software versions and system details, potentially aiding attackers in targeting known vulnerabilities.

AnalysisAI

HCL BigFix Service Management exposes server banner information containing software versions and system details accessible to adjacent network attackers through a non-default interaction, enabling reconnaissance for targeted attacks against known vulnerabilities. The vulnerability requires adjacent network access and user interaction, resulting in limited confidentiality impact with no integrity or availability consequences. CVSS 2.6 indicates low severity, though information disclosure can facilitate secondary attacks.

Technical ContextAI

Server banner disclosure is a classic information gathering weakness (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) where HTTP headers or service banners reveal software versions, architecture, or framework details. In HCL BigFix Service Management, the application server exposes identifying information through response headers or welcome messages, allowing attackers on the adjacent network segment to enumerate the exact software version without authentication. This reconnaissance data can then be correlated with known CVE databases to identify additional exploitable vulnerabilities in the specific version. The vulnerability appears to be a configuration or default behavior issue rather than a code flaw.

RemediationAI

Check HCL support article KB0128144 at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0128144 for the vendor-issued patch or mitigation guidance. If a patch version is available, upgrade BigFix SM to the patched release immediately. As a compensating control pending patching, implement network-level protections: (1) restrict HTTP(S) access to BigFix SM services to authorized subnets only using firewall rules, preventing adjacent network reconnaissance; (2) disable or customize HTTP headers to remove version strings-configure the application server (typically Tomcat or similar) to suppress the Server header in responses; (3) place BigFix SM behind a reverse proxy (nginx, Apache) configured to strip identifying headers before forwarding responses to clients. Document any header suppression configuration changes to maintain supportability. These controls reduce information leakage without patching but do not address the root cause and must be paired with patch deployment.