CVE-2025-31963 — HCL BigFix IVR is impacted by improper authentication and missing CSRF protection

CVE-2025-31963

HCL BigFix IVR is impacted by improper authentication and missing CSRF protection PUBLISHED

Description (CNA)

Improper authentication and missing CSRF protection in the local setup interface component in HCL BigFix IVR version 4.2 allows a local attacker to perform unauthorized configuration changes via unauthenticated administrative configuration requests.

Affected (CNA)

Vendor / product	Versions
HCLSoftware / BigFix IVR	affected 4.2

CWE

CWE-306, CWE-352

References

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0127753

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.