CVE-2025-31964
LowCVSS 2.2Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
Improper service binding configuration in internal service components in HCL BigFix IVR version 4.2 allows a privileged attacker to impact service availability via exposure of administrative services bound to external network interfaces instead of the local authentication interface.
Risk Assessment
Exposure of administrative services to external networks could allow unauthorized access and disruption of services, leading to availability issues.
Recommendation
Configure services to bind only to the local authentication interface and restrict network access to administrative services.
Other vulnerabilities in HCL BigFix IVR
See all- CVE-2025-31963Low
Improper authentication and missing CSRF protection in the local setup interface component in HCL BigFix IVR version 4.2 allows a local attacker to perform unauthorized configuration changes via unauthenticated administrative configuration requests.
- CVE-2025-31962Low
Insufficient session expiration in the Web UI authentication component in HCL BigFix IVR version 4.2 allows an authenticated attacker to gain prolonged unauthorized access to protected API endpoints due to excessive expiration periods.
Original NVD description (English source)
Improper service binding configuration in internal service components in HCL BigFix IVR version 4.2 allows a privileged attacker to impact service availability via exposure of administrative services bound to external network interfaces instead of the local authentication interface.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS