CVE-2025-31963
Unknown
Unknown - Not Provided
Improper Authentication and CSRF in HCL BigFix IVR Setup
Publication date: 2026-01-07
Last updated on: 2026-01-07
Assigner: HCL Software
Description
Description
Improper authentication and missing CSRF protection in the local setup interface component in HCL BigFix IVR version 4.2 allows a local attacker to perform unauthorized configuration changes via unauthenticated administrative configuration requests.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| hcl | bigfix | 4.2 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves improper authentication and missing CSRF protection in the local setup interface component of HCL BigFix IVR version 4.2. It allows a local attacker to make unauthorized configuration changes by sending unauthenticated administrative configuration requests.
How can this vulnerability impact me? :
The vulnerability can allow a local attacker to perform unauthorized configuration changes, potentially compromising the security and integrity of the system by altering settings without proper authorization.
Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70