CVE-2025-31981: HCL BigFix Service Management (SM) Discovery is vulnerable to unenforced encryption
HCL BigFix Service Management (SM) Discovery is vulnerable to unenforced encryption due to port 80 (HTTP) being open, allowing unencrypted access. An attacker with access to the network traffic can sniff packets from the connection and uncover the data.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-31981?
CVE-2025-31981 is considered a moderate severity vulnerability due to the risk of unencrypted traffic allowing potential data interception.
How do I fix CVE-2025-31981?
To mitigate CVE-2025-31981, it is recommended to enforce encryption by securing the HTTP traffic on port 80 with HTTPS.
What are the potential impacts of CVE-2025-31981?
CVE-2025-31981 could allow attackers to intercept sensitive data transmitted over unencrypted connections.
Which versions of HCL BigFix Service Management (SM) Discovery are affected by CVE-2025-31981?
All versions of HCL BigFix Service Management (SM) Discovery that leave port 80 open and do not enforce encryption are affected by CVE-2025-31981.
Is CVE-2025-31981 exploitable remotely?
Yes, CVE-2025-31981 can be exploited remotely by attackers with access to the network where unencrypted traffic is transmitted.