VULNERABILITY INTELLIGENCE

CVE-2025-31963

CVSS score2.9 LOW
EPSS probability0.09%
CISA KEVNot currently listed
Published2026-01-07
Last modified2026-10-07
CVSS vectorCVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N

Description

Improper authentication and missing CSRF protection in the local setup interface component in HCL BigFix IVR version 4.2 allows a local attacker to perform unauthorized configuration changes via unauthenticated administrative configuration requests.

Weakness classification

  • psirt@hcl.com: CWE-306
  • nvd@nist.gov: CWE-352

Primary references