CVE-2025-31963CWE-306CWE-352csrf

CVE-2025-31963

Low · published January 7, 2026

CVSS v3.1
2.9
EPSS
0%
Percentile
0.5
In the wild
Unconfirmed
What it is

Improper authentication and missing CSRF protection in the local setup interface component in HCL BigFix IVR version 4.2 allows a local attacker to perform unauthorized configuration changes via unauthenticated administrative configuration requests.

The record
Technical detail
CVSS v3.1
2.9 · LOW
Vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00093 · 0.5th percentile
Weaknesses
CWE-306 · Missing Authentication for Critical Function; CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2026-01-07T17:17Z
Affected products (1)
ProductVersionsFixed in
hcltech/bigfix_insights_for_vulnerability_remediationall versions—
References (1)
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0127753 · [email protected]
EPSS history
Timeline
  • 07 JAN 07:05Z
    HCL BigFix IVR is impacted by improper authentication and missing CSRF protection
    cvelistv5