← Vulnerability feed

Vulnerability record · CVE-2025-31972 · published 28 August 2025

CVE-2025-31972: Hcltech bigfix service management cleartext transmission vulnerability

Hcltech · Bigfix Service Management

HCL BigFix SM is affected by a Sensitive Information Exposure vulnerability where internal connections do not use TLS encryption which could allow an attacker unauthorized access to sensitive data transmitted between internal components.

6.5 CVSS 3.1 Medium EPSS 0.09% · top 99.4% CWE-319 · Cleartext transmission
6.5CVSS 3.1 base score
0.09%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
1References
26 Sep 2026Last modified by NVD

Description

HCL BigFix SM is affected by a Sensitive Information Exposure vulnerability where internal connections do not use TLS encryption which could allow an attacker unauthorized access to sensitive data transmitted between internal components.

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0123631 Vendor Advisory

Track CVE-2025-31972 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2025-31973Hcltech bigfix service management vulnerabilityHCL BigFix Service Management (SM) is susceptible to a Configuration – 'Insecure Use of Base Image Version'. Using outdated or insecure base images m…EPSS 0.18%8.8CVE-2025-52613Hcltech bigfix service management information exposure vulnerabilityHCL BigFix Service Management (SM) is affected by use of a vulnerable WSGI Server was identified. Deploying an outdated or insecure WSGI server may e…EPSS 0.23%8.3CVE-2024-30151Hcltech bigfix service management sensitive information in log file vulnerabilityHCL BigFix Service Management (SX) is affected by a Broken Access Control vulnerability leading to privilege escalation. This could allow unauthorize…EPSS 0.25%8.2CVE-2025-31958Hcltech bigfix service management http request smuggling vulnerabilityHCL BigFix Service Management is susceptible to HTTP Request Smuggling.  HTTP request smuggling vulnerabilities arise when websites route HTTP reques…EPSS 0.18%7.5CVE-2025-31976Hcltech bigfix service management information exposure vulnerabilityHCL BigFix Service Management (SM) is vulnerable to insufficiently protected credentials for a short duration while communicating with a backend, int…EPSS 0.16%7.2CVE-2025-31974Hcltech bigfix service management insecure default initialization vulnerabilityHCL BigFix Service Management (SM) is susceptible to a Root File System Not Mounted as Read-Only. An improperly configured root file system may allow…EPSS 0.18%6.5CVE-2025-31985Hcltech bigfix service management information exposure vulnerabilityHCL BigFix Service Management (SM) is affected by a security misconfiguration due to a missing or insecure “X-Content-Type-Options” header. This coul…EPSS 0.16%6.5CVE-2025-31982Hcltech bigfix service management information exposure vulnerabilityHCL BigFix Service Management (SM) had directories that were not linked or publicly visible but could be accessed directly. This could allow an incre…EPSS 0.15%

Source: NIST National Vulnerability Database (record CVE-2025-31972), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.