What is the CVSS score of CVE-2025-52613?

CVE-2025-52613 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of HCL BigFix SM are affected by CVE-2025-52613?

HCL BigFix Service Management (SM) version 23 bundles an outdated WSGI web server component, leaving the SM web front end carrying the cumulative, currently unidentified security weaknesses of that…

How to fix or mitigate CVE-2025-52613?

Within 24 hours, inventory every HCL BigFix Service Management 23 instance and confirm which of them expose the SM web front end to untrusted networks; for any internet-facing or broadly reachable deployment, restrict access at the firewall or reverse proxy to known administrative source ranges, enforce MFA and least-privilege accounts on the SM web tier, and enable verbose access logging and alerting on anomalous requests to that component. Within 7 days, open a formal case with HCL support to obtain the exact WSGI server version pinned in SM 23 and any interim guidance or hotfix, place the SM web tier behind a hardened reverse proxy or WAF with generic WSGI/HTTP abuse signatures enabled, review and trim all low-privileged accounts that can authenticate to the front end, and re-scan the estate to confirm no unauthorised instance is reachable. Within 30 days, schedule upgrade or rebuild of affected SM 23 hosts once HCL publishes a fixed release or a supported configuration that replaces the outdated WSGI component, validate the change in a non-production environment first, and fold WSGI/application-server version currency into routine vulnerability management so bundled dependencies are reviewed at each SM release; note that no vendor-released patch was identified at time of analysis, so these interim measures are the control set until vendor remediation exists.

HCL BigFix SM CVE-2025-52613

EUVD-2025-209702 HIGH

Information Exposure (CWE-200)

2026-05-06 HCL

GHSA-vrr6-hxxc-pgc8

Authentication Bypass Information Disclosure Bigfix Service Management Sm Hcl

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Network-facing web app keeps AV:N and PR:L, but AC:H reflects that exploitability depends on unspecified reachable WSGI weaknesses; impacts retained at vendor's H pending identification of the concrete flaw.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Sep 30, 2026 - 22:41 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Sep 30, 2026 - 22:23 vuln.today

cvss_changed

Severity Changed

Sep 30, 2026 - 22:23 NVD

MEDIUM HIGH

CVSS changed

Sep 30, 2026 - 22:23 NVD

4.6 (MEDIUM) 8.8 (HIGH)

Analysis Generated

May 06, 2026 - 15:00 vuln.today

DescriptionNVD

HCL BigFix Service Management (SM) is affected by use of a vulnerable WSGI Server was identified. Deploying an outdated or insecure WSGI server may expose the application to known security weaknesses, potentially increasing the risk of exploitation and unauthorized access.

AnalysisAI

HCL BigFix Service Management (SM) version 23 ships with an outdated, vulnerable WSGI (Web Server Gateway Interface) server component, which can expose the application to the known security weaknesses of that unnamed server release and potentially enable unauthorized access or information disclosure. Exploitation requires a network-reachable deployment of the affected SM web front end and a low-privileged authenticated position per the CVSS vector (PR:L), and its real-world risk is gated by whatever specific flaws exist in the pinned WSGI version rather than by a documented, directly triggerable bug. No public exploit code or confirmed active exploitation has been identified (CISA SSVC rates exploitation 'none' and automatable 'no'), and EPSS is very low at 0.02% (7th percentile), so this should be treated as a component-currency and hardening issue rather than an urgent, weaponized threat.

Technical ContextAI

The CVE describes a bundled-component weakness rather than a flaw in HCL's own code: BigFix Service Management (SM) 23 embeds a WSGI server, the Python-side interface layer that mediates HTTP requests between a reverse proxy/web server and the application, and that embedded server version is outdated or insecurely configured. WSGI servers sit directly on the request path, so weaknesses in them (request smuggling or parsing discrepancies, header handling, path traversal, error-page/stack-trace leakage, denial of service) translate into downstream exposure of the application itself. The CVE is mapped to CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), with associated tags for Authentication Bypass and Information Disclosure, indicating the expected impact class is leakage of data or bypass of controls rather than direct remote code execution. The relevant CPE is cpe:2.3:a:hcl:bigfix_service_management_(sm):*:*:*:*:*:*:*:*, and the EUVD record scopes affected versions to 'BigFix Service Management (SM) 23'. Notably, the published CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) rates attack complexity as Low, whereas independent assessment raises it to High (AC:H) because actual exploitability depends entirely on which specific known weaknesses are present in the unnamed WSGI build - this is a latent hygiene defect, not a demonstrated triggerable vulnerability.

RemediationAI

Because the defect is an embedded component rather than an application-logic bug, the primary fix is to install the current HCL BigFix Service Management 23 maintenance release that refreshes or replaces the bundled WSGI server, and to follow HCL knowledge-base article KB0128144 (https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0128144) for the exact patched build - the provided data does not identify a specific fixed version number, so verify against the vendor advisory before scheduling the upgrade. Until the upgrade is applied, compensate by placing the BigFix SM web interface behind a hardened reverse proxy that normalizes and validates request framing (to blunt request-smuggling and header-manipulation attempts), disabling or masking verbose error pages and stack traces so the WSGI layer cannot leak sensitive data (the CWE-200 concern), and restricting network reachability of the SM console to trusted management subnets or VPN-only access, accepting that this reduces administrative convenience for remote staff. Additionally, review WSGI server logging and configuration for exposed debug endpoints, enforce least privilege on SM service accounts so any authentication-bypass attempt (per the associated tag) lands on a low-privileged principal, and monitor the HCL advisory feed for the specific patched release; the EPSS score of 0.02% and the absence of a public exploit mean these mitigations can be applied on a normal patch cadence rather than under emergency change procedures.