What is the CVSS score of CVE-2025-31982?

CVE-2025-31982 has a CVSS 3.1 base score of 3.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:L. EPSS exploitation probability: 0.0%.

HCL BigFix Service Management CVE-2025-31982

EUVD-2025-209697 LOW

Information Exposure (CWE-200)

2026-05-06 HCL

GHSA-r7c2-39pq-6jh8

Information Disclosure Bigfix Service Management Sm

3.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.7 LOW

AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 15:00 vuln.today

DescriptionCVE.org

HCL BigFix Service Management (SM) had directories that were not linked or publicly visible but could be accessed directly. This could allow an increased risk of information disclosure or misuse of sensitive functionality.

AnalysisAI

HCL BigFix Service Management contains unauthenticated-accessible directories that are not linked in the user interface but can be reached through direct URL access, enabling authenticated users with low privileges to disclose sensitive information or access restricted functionality. The vulnerability requires authenticated access, user interaction, and higher-than-average attack complexity; active exploitation status has not been confirmed.

Technical ContextAI

HCL BigFix Service Management (SM) is an IT operations and change management platform. The vulnerability stems from improper access controls on web application directories (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor). These directories lack proper authentication or authorization checks despite not being exposed through normal navigation paths. An attacker who gains low-privilege authenticated access (PR:L per CVSS vector) and can interact with a logged-in user (UI:R) can construct direct URLs to reach these hidden directories, bypassing the intended user interface abstraction layer. The attack vector is network-based (AV:N), but requires authenticated session context and user interaction, limiting attack surface.

RemediationAI

HCL has released security updates addressing this vulnerability; customers should consult HCL support bulletin KB0128144 for specific patched version numbers and upgrade timelines. Immediate compensating controls include: (1) Restrict direct URL access to BigFix SM administrative directories using web application firewall (WAF) rules or reverse proxy configurations to block requests to known sensitive paths, noting this may impact legitimate administrative workflows and must be tested in staging; (2) Implement IP-based access controls limiting BigFix SM access to trusted administrative networks and VPN ranges, reducing exposure to opportunistic remote attackers; (3) Enforce multi-factor authentication (MFA) for all BigFix SM user accounts, particularly administrative and service accounts, to prevent low-privilege authenticated access even if credentials are compromised; (4) Audit and revoke unnecessary low-privilege accounts, minimizing the PR:L attack surface. These controls are temporary pending patching and should not replace vendor updates.