CVE-2025-31962CWE-613

CVE-2025-31962

Low · published January 7, 2026

CVSS v3.1
2.0
EPSS
0%
Percentile
7.4
In the wild
Unconfirmed
What it is

Insufficient session expiration in the Web UI authentication component in HCL BigFix IVR version 4.2 allows an authenticated attacker to gain prolonged unauthorized access to protected API endpoints due to excessive expiration periods.

The record
Technical detail
CVSS v3.1
2.0 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00182 · 7.4th percentile
Weakness
CWE-613 · Insufficient Session Expiration
Published
2026-01-07T17:17Z
Affected products (1)
ProductVersionsFixed in
hcltech/bigfix_insights_for_vulnerability_remediationall versions—
References (1)
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0127753 · [email protected]
EPSS history
Timeline
  • 07 JAN 06:48Z
    HCL BigFix IVR is impacted by an insufficient session expiration vulnerability
    cvelistv5