CVE-2025-31957
Analyzed Analyzed - Analysis Complete
Cross-Site Request Forgery in HCL BigFix Service Management

Publication date: 2026-05-06

Last updated on: 2026-05-07

Assigner: HCL Software

Description
HHCL BigFix Service Management (SM) is affected by a Cross‑Site Request Forgery (CSRF) vulnerability. This could lead to unauthorized changes or exposure of sensitive data.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-06
Last Modified
2026-05-07
Generated
2026-06-16
AI Q&A
2026-05-06
EPSS Evaluated
2026-06-15
NVD
CVE-2025-31957
EUVD
EUVD-2025-209687
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
hcltech bigfix_service_management 23.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The vulnerability in HHCL BigFix Service Management (SM) is a Cross-Site Request Forgery (CSRF) issue. This means that an attacker could trick a user into performing unauthorized actions on the system without their consent.

Impact Analysis

This vulnerability could lead to unauthorized changes being made within the system or the exposure of sensitive data.

Compliance Impact

The vulnerability in HHCL BigFix Service Management (SM) is a Cross-Site Request Forgery (CSRF) that could lead to unauthorized changes or exposure of sensitive data.

Exposure of sensitive data due to this vulnerability could potentially impact compliance with data protection regulations such as GDPR or HIPAA, which require safeguarding sensitive information against unauthorized access or modification.

However, specific impacts on compliance with these standards are not detailed in the provided information.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-31957. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart