CVE-2025-31963 — LOW (2.9) — White Hats Nepal

Vulnerability Description

Improper authentication and missing CSRF protection in the local setup interface component in HCL BigFix IVR version 4.2 allows a local attacker to perform unauthorized configuration changes via unauthenticated administrative configuration requests.

CVSS Score

2.9

LOW

CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

LOW

Integrity

LOW

Availability

NONE

Affected Products

Vendor	Product	Versions
Hcltech	Bigfix Insights For Vulnerability Remediation	4.2

Related Weaknesses (CWE)

CWE-306 CWE-352

References

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0127753Vendor Advisory

FAQ

What is CVE-2025-31963?

CVE-2025-31963 is a vulnerability with a CVSS score of 2.9 (LOW). Improper authentication and missing CSRF protection in the local setup interface component in HCL BigFix IVR version 4.2 allows a local attacker to perform unauthorized configuration changes via unaut...

How severe is CVE-2025-31963?

CVE-2025-31963 has been rated LOW with a CVSS base score of 2.9/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2025-31963?

Check the references section above for vendor advisories and patch information. Affected products include: Hcltech Bigfix Insights For Vulnerability Remediation.