CVE-2025-31973 identifies a vulnerability in HCL BigFix Service Management (SM) version 23 due to the insecure use of outdated or vulnerable base images. This dependency on vulnerable third-party components (CWE-1395) can introduce known security weaknesses into the environment where the product is deployed. The vulnerability has a CVSS 3.1 base score of 4.0, reflecting low attack vector (local), low complexity, high privileges required, and user interaction needed, with limited impact on confidentiality, integrity, and availability.

The vulnerability may allow attackers with local access and high privileges to exploit known weaknesses in the outdated base images, potentially leading to limited confidentiality, integrity, and availability impacts within the affected environment. However, the risk is moderated by the requirement for local access, high privileges, and user interaction. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should review and update base images used in their deployment of HCL BigFix Service Management (SM) version 23 to ensure they do not contain known vulnerabilities. Monitoring vendor communications for updates is recommended.