CVE-2025-31973 is a medium severity configuration weakness (CVSS 4.0) in HCL BigFix Service Management. The product used an outdated or insecure container base image, which can carry known vulnerabilities. I could not read the vendor article, so check HCL's KB0128144 for the fixed version.
What's affected
The record says HCL BigFix Service Management (SM) is susceptible to a configuration issue titled "Insecure Use of Base Image Version". Using outdated or insecure base images may introduce known vulnerabilities and increase the risk of exploitation in the application environment.
The record lists no affected version range and no CWE. The reference is HCL's knowledge base article KB0128144, which sits behind a web challenge that my tools could not pass, so I cannot confirm the affected or fixed versions. Please open the article yourself for that.
The CVSS vector (4.0) is local, needs high privileges and user interaction, and shows low impact across the board. That makes this a hygiene item rather than an emergency.
How to check if you're exposed
Because the weakness is in the container base image, the check is an image scan.
- Read HCL's article KB0128144 for the affected and fixed versions of BigFix Service Management.
- Find out how your deployment runs. If it uses container images, list them and the versions.
- Scan the images for known vulnerabilities:
docker image ls
Pass each image to your scanner and compare the base operating system packages with current patched versions.
Run this check after each update too, since a base image can fall behind again quickly.
What to do now
- Read HCL's advisory KB0128144 and note the fixed release.
- Update BigFix Service Management to the fixed version, following the vendor's upgrade steps.
- Scan the running container images before and after the update for known vulnerable packages.
- Rebuild or pull fresh images on a schedule so base layers do not age.
- Keep an image inventory so you know which services run which base.
Why it matters
The record has no CWE for this one. The category is plain: a product shipped on an old foundation. Base images bundle an operating system's libraries and tools, and each package in them has its own vulnerability history. An image that is not rebuilt gathers known issues over time, even if the application code never changes.
The score is low and the vector requires high privileges and user interaction. The record does not list the CVE in CISA's Known Exploited Vulnerabilities catalog. The real value of the finding is as a reminder: scan the images you run, not only the code you write.
Scanning images before they ship
The demo shows an image scan listing vulnerable packages by layer. The free in-browser dependency scan at https://gold.safeguard.sh/scan checks a manifest against known vulnerabilities without installing anything. The Gold directory pages for each CVE and CWE collect the same facts in one place.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is this an urgent patch?
The CVSS score is 4.0 and the vector is local with high privileges. Schedule it, and check HCL's article for specifics.
Why can an old base image matter if the app is fine?
Base images carry operating system packages with their own known vulnerabilities, which sit in the container whether or not the app uses them.
Sources
Last reviewed: 19 October 2026.
