CVE-2025-31963

LOW
2026-01-07 [email protected]
2.9
CVSS 3.1

CVSS Vector

CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N
Attack Vector
Local
Attack Complexity
High
Privileges Required
High
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

2
Analysis Generated
Mar 12, 2026 - 21:54 vuln.today
CVE Published
Jan 07, 2026 - 12:17 nvd
LOW 2.9

Tags

CSRF

Description

Improper authentication and missing CSRF protection in the local setup interface component in HCL BigFix IVR version 4.2 allows a local attacker to perform unauthorized configuration changes via unauthenticated administrative configuration requests.

Analysis

Bigfix Insights For Vulnerability Remediation versions up to 4.2 is affected by missing authentication for critical function (CVSS 2.9).

Technical Context

This vulnerability (CWE-306: Missing Authentication for Critical Function) exists in the local setup component. Improper authentication and missing CSRF protection in the local setup interface component in HCL BigFix IVR version 4.2 allows a local attacker to perform unauthorized configuration changes via unauthenticated administrative configuration requests.

Affected Products

Vendor: Hcltech. Product: Bigfix Insights For Vulnerability Remediation. Versions: up to 4.2. Component: local setup.

Remediation

Monitor vendor advisories for a patch.

Priority Score

15
Low Medium High Critical
KEV: 0
EPSS: +0.0
CVSS: +14
POC: 0

Share

CVE-2025-31963 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy