CVE-2025-31962 — HCL BigFix IVR is impacted by an insufficient session expiration vulnerability

CVE-2025-31962

HCL BigFix IVR is impacted by an insufficient session expiration vulnerability PUBLISHED

Description (CNA)

Insufficient session expiration in the Web UI authentication component in HCL BigFix IVR version 4.2 allows an authenticated attacker to gain prolonged unauthorized access to protected API endpoints due to excessive expiration periods.

Affected (CNA)

Vendor / product	Versions
HCLSoftware / BigFix IVR	affected 4.2

CWE

CWE-613

References

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0127753

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.