CVE-2025-31977
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
HCL BigFix SM is affected by a cryptographic weakness due to weak or outdated encryption algorithms. An attacker with network access could exploit this weakness to decrypt or manipulate encrypted communications under certain conditions.
Risk Assessment
An attacker could intercept or modify confidential communications, potentially leading to data confidentiality and integrity breaches.
Recommendation
Update HCL BigFix SM to a version using strong, modern encryption algorithms and configure secure protocols.
Other vulnerabilities in HCL BigFix SM
See all- CVE-2025-31979Medium
A File Upload Validation Bypass vulnerability has been identified in HCL BigFix SM, where the application fails to properly enforce file type restrictions during the upload process. An attacker may exploit this flaw to upload malicious or unauthorized files, such as scripts, executables, or web shells, by bypassing client-side or server-side validation mechanisms.
- CVE-2025-31972Medium
HCL BigFix SM is affected by a Sensitive Information Exposure vulnerability where internal connections do not use TLS encryption which could allow an attacker unauthorized access to sensitive data transmitted between internal components.
Original NVD description (English source)
HCL BigFix SM is affected by cryptographic weakness due to weak or outdated encryption algorithms. An attacker with network access could exploit this weakness to decrypt or manipulate encrypted communications under certain conditions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS