CVE-2025-31958 - CVE House
Back to Database
Status published Low CVE-2025-31958

HCL BigFix Service Management (SM) is susceptible to HTTP Request Smuggling

Vulnerability Description

HCL BigFix Service Management is susceptible to HTTP Request Smuggling.  HTTP request smuggling vulnerabilities arise when websites route HTTP requests through web servers with inconsistent HTTP parsing. HTTP Smuggling exploits inconsistencies in request parsing between front-end and back-end servers, allowing attackers to bypass security controls and perform attacks like cache poisoning or request hijacking.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-31958

Credits & Attribution

No credits recorded in the NVD database.

References

More from HCLSoftware

View All →
CVE-2025-62338
HCL BigFix Cloud Lifecycle Management is affected by lack of input validation
Low 3.3
CVE-2025-62328
HCL Nomad server on Domino is affected by a missing default frame-ancestors directive
Low 3.7
CVE-2025-62327
HCL DevOps Deploy is susceptible to insufficiently protected credentials
Medium 4.9
CVE-2025-62326
HCL Digital Experience is susceptible to stored cross-site scripting (XSS)
Medium 6.1
CVE-2025-59868
HCL Traveler for Microsoft Outlook (HTMO) is susceptible to sensitive data exposure
Medium 5.5

Affected Vendor

HCLSoftware

View all reports →

Affected Software

BigFix Service Management (SM)
Vulnerable Versions:
23

Timeline

Official Publish: April 21st, 2026
Last Modified: April 21st, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

CWE-444

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1565.002 Stored Data Manipulation
Impact
T1078 Valid Accounts
Defense Evasion