CVE-2025-31957 is a CSRF vulnerability in HCL BigFix Service Management (SM) version 23. It allows an attacker to induce an authenticated user to perform unwanted actions without their consent, potentially leading to unauthorized changes or exposure of sensitive data. The vulnerability has a low CVSS score of 2.6, reflecting a network attack vector with high attack complexity, requiring low privileges and user interaction, and resulting in limited confidentiality impact without affecting integrity or availability. No vendor-provided patch or official remediation level is currently documented.

The vulnerability could lead to unauthorized changes or exposure of sensitive data within the affected product. However, the impact is limited to confidentiality loss with no direct integrity or availability impact reported. The low CVSS score reflects a low severity risk. There are no known active exploits targeting this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing standard CSRF mitigations such as verifying anti-CSRF tokens in requests and limiting the exposure of authenticated sessions. Monitor vendor communications for updates on patches or official mitigations.