EUVD-2025-209705Severity by source
AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L
Lifecycle Timeline
1DescriptionCVE.org
HCL BigFix Service Management (SM) is susceptible to a Root File System Not Mounted as Read-Only. An improperly configured root file system may allow
unintended modifications to critical system components, potentially increasing the risk of system compromise or unauthorized changes.
AnalysisAI
HCL BigFix Service Management is vulnerable to improper root filesystem configuration, allowing high-privileged authenticated users with user interaction to make unauthorized modifications to critical system components. The vulnerability requires administrative privileges and user consent (CVSS:3.1/AV:N/AC:H/PR:H/UI:R), resulting in limited confidentiality, integrity, and availability impacts. No active exploitation has been publicly reported.
Technical ContextAI
The vulnerability stems from CWE-1188 (Initialization with Hard-Coded Network Resource Configuration Data), which in this context manifests as a root filesystem not being mounted as read-only. This misconfiguration violates security hardening best practices where critical system directories should be protected from unauthorized modifications. The issue affects HCL BigFix Service Management across all versions in the cpe:2.3:a:hcl_software:bigfix_service_management_(sm) namespace, suggesting a systemic configuration issue rather than a code defect in a specific component or library.
RemediationAI
Organizations should apply the guidance provided in HCL support article KB0128144 at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0128144, which addresses the improper root filesystem configuration. The primary remediation is to ensure the root filesystem is mounted as read-only through proper storage and mount configuration during deployment or reconfiguration of BigFix Service Management. Where applicable, enable filesystem integrity monitoring (such as AIDE or Tripwire) to detect unauthorized modifications to critical system components. Alternatively, use containerized or immutable deployment models that inherently enforce read-only root filesystems and reduce the attack surface for post-deployment modifications.
More in Bigfix Service Management Sm
View allHCL BigFix Service Management (SX) is affected by a Broken Access Control vulnerability leading to privilege escalation.
Credential exposure in HCL BigFix Service Management (SM) version 23 leaves credentials insufficiently protected for a b
HCL BigFix Service Management (SM) leaks sensitive information through improper error handling in its reporting module.
HCL BigFix Service Management Discovery accepts unencrypted HTTP traffic on port 80, allowing network-adjacent attackers
HCL BigFix Service Management (SM) contains an insecure or outdated WSGI server implementation that exposes the applicat
HCL BigFix Service Management fails to sanitize spreadsheet data (CSV, XLS, XLSX) before export, allowing authenticated
HCL BigFix Service Management lacks secure X-Content-Type-Options HTTP headers, allowing browsers to perform MIME-type s
HTTP request smuggling in HCL BigFix Service Management allows remote unauthenticated attackers to exploit HTTP parsing
HCL BigFix Service Management contains unauthenticated-accessible directories that are not linked in the user interface
HCL BigFix Service Management (SM) contains a Content Security Policy (CSP) header misconfiguration that enables cross-s
HCL BigFix Service Management fails to strip EXIF metadata from uploaded images, allowing authenticated users to inadver
HCL BigFix Service Management (SM) contains a cross-site request forgery (CSRF) vulnerability that allows authenticated
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today