Medium severity · published Aug 28, 2025
CVE-2025-31977
HCL BigFix SM is affected by cryptographic weakness due to weak or outdated encryption algorithms. An attacker with network access could exploit this weakness to decrypt or…
6.5
CVSS
0.1%
EPSS
No
On KEV
Description
HCL BigFix SM is affected by cryptographic weakness due to weak or outdated encryption algorithms. An attacker with network access could exploit this weakness to decrypt or manipulate encrypted communications under certain conditions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 1% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BS
Bigfix Service Management · Hcltech
23.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-31977
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-31977
Vendor Advisory
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0123631
More from Bigfix Service Management
9.8
CVE-2026-21806
HCL BigFix Service Management was affected with Admin Session Concurrency vulnerability (CVE-2026-21806)
9.8
CVE-2026-56592
HCL BigFix Service Management is affected by multiple security vulnerabilities.
9.8
CVE-2026-56590
HCL BigFix Service Management is affected by multiple security vulnerabilities.
9.8
CVE-2026-67100
HCL BigFix Service Management is affected by multiple security vulnerabilities.
9.8
CVE-2025-31973
HCL BigFix Service Management (SM) is susceptible to a Configuration – 'Insecure Use of Base Image Version'