CVE-2025-31964
Unknown Unknown - Not Provided

Improper Service Binding in HCL BigFix IVR Causes Service Disruption

Publication date: 2026-01-07

Last updated on: 2026-01-07

Assigner: HCL Software

Description
Improper service binding configuration in internal service components in HCL BigFix IVR version 4.2 allows a privileged attacker to impact service availability via exposure of administrative services bound to external network interfaces instead of the local authentication interface.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-01-07
Last Modified
2026-01-07
Generated
2026-07-06
AI Q&A
2026-01-07
EPSS Evaluated
2026-07-05
NVD
CVE-2025-31964
EUVD
EUVD-2026-1266

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
hcl bigfix 4.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-419 The product uses a primary channel for administration or restricted functionality, but it does not properly protect the channel.
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is due to improper service binding configuration in internal service components of HCL BigFix IVR version 4.2. It allows a privileged attacker to affect service availability by exposing administrative services to external network interfaces instead of restricting them to the local authentication interface.

Impact Analysis

The vulnerability can impact you by allowing a privileged attacker to disrupt service availability, potentially causing denial of service or other availability issues due to exposure of administrative services to external networks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-31964. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart