CVE-2025-31982 is a vulnerability in HCL BigFix Service Management (SM) version 23 where unlinked directories are accessible directly, potentially exposing sensitive information or functionality to unauthorized users. The vulnerability is categorized as CWE-200 (Exposure of Sensitive Information). The CVSS 3.1 base score is 3.7, indicating low severity with network attack vector, high attack complexity, low privileges required, and user interaction needed. No vendor advisory or patch information is currently available, and the product is not a cloud service, so remediation depends on vendor updates.

The vulnerability could allow unauthorized actors to access sensitive information or misuse sensitive features by directly accessing unlinked directories. The impact is limited to information disclosure with no known integrity or availability impact beyond a low-level availability impact. The low CVSS score reflects that exploitation requires user interaction and has high attack complexity, limiting the likelihood and impact of successful exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level is provided, users should monitor HCL Software advisories for updates. Until a fix is available, restrict access to the affected directories through network controls or web server configuration to prevent direct access where possible.