CVE-2025-31962
LowCVSS 2.0Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Insufficient session expiration in the Web UI authentication component in HCL BigFix IVR version 4.2 allows an authenticated attacker to gain prolonged unauthorized access to protected API endpoints due to excessive expiration periods.
Risk Assessment
An authenticated attacker could maintain access to protected APIs for longer than intended, increasing the risk of unauthorized access to data and system functions.
Recommendation
Reduce session expiration periods in the HCL BigFix IVR Web UI and apply available security updates.
Other vulnerabilities in HCL BigFix IVR
See all- CVE-2025-31964Low
Improper service binding configuration in internal service components in HCL BigFix IVR version 4.2 allows a privileged attacker to impact service availability via exposure of administrative services bound to external network interfaces instead of the local authentication interface.
- CVE-2025-31963Low
Improper authentication and missing CSRF protection in the local setup interface component in HCL BigFix IVR version 4.2 allows a local attacker to perform unauthorized configuration changes via unauthenticated administrative configuration requests.
Original NVD description (English source)
Insufficient session expiration in the Web UI authentication component in HCL BigFix IVR version 4.2 allows an authenticated attacker to gain prolonged unauthorized access to protected API endpoints due to excessive expiration periods.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS