VULNERABILITY INTELLIGENCE

CVE-2025-31962

CVSS score2 LOW
EPSS probability0.18%
CISA KEVNot currently listed
Published2026-01-07
Last modified2026-10-07
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N

Description

Insufficient session expiration in the Web UI authentication component in HCL BigFix IVR version 4.2 allows an authenticated attacker to gain prolonged unauthorized access to protected API endpoints due to excessive expiration periods.

Weakness classification

  • psirt@hcl.com: CWE-613

Primary references