CVE-2025-31963
LowCVSS 2.9Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
Improper authentication and missing CSRF protection in the local setup interface component in HCL BigFix IVR version 4.2 allows a local attacker to perform unauthorized configuration changes via unauthenticated administrative configuration requests.
Risk Assessment
A local attacker can change system configuration without authentication, potentially leading to privilege escalation or service disruption.
Recommendation
Restrict access to the local setup interface, implement authentication and CSRF protection, and update HCL BigFix IVR to a version containing the fix.
Other vulnerabilities in HCL BigFix IVR
See all- CVE-2025-31964Low
Improper service binding configuration in internal service components in HCL BigFix IVR version 4.2 allows a privileged attacker to impact service availability via exposure of administrative services bound to external network interfaces instead of the local authentication interface.
- CVE-2025-31962Low
Insufficient session expiration in the Web UI authentication component in HCL BigFix IVR version 4.2 allows an authenticated attacker to gain prolonged unauthorized access to protected API endpoints due to excessive expiration periods.
Original NVD description (English source)
Improper authentication and missing CSRF protection in the local setup interface component in HCL BigFix IVR version 4.2 allows a local attacker to perform unauthorized configuration changes via unauthenticated administrative configuration requests.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS