HCL Software BigFix IVR vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting HCL Software BigFix IVR: 3 record(s), with affected versions and fixes.
CVE-2025-31964
Medium · 4.9
CWE-200 Jan 7, 2026
HCL BigFix IVR is impacted by an improper service binding configuration
Improper service binding configuration in internal service components in HCL BigFix IVR version 4.2 allows a privileged attacker to impact service availability via exposure of administrative services bound to external network interfaces instead of the local authentication interface.
CVE-2025-31963
Low · 3.3
CWE-352 Jan 7, 2026
HCL BigFix IVR is impacted by improper authentication and missing CSRF protection
Improper authentication and missing CSRF protection in the local setup interface component in HCL BigFix IVR version 4.2 allows a local attacker to perform unauthorized configuration changes via unauthenticated administrative configuration requests.
CVE-2025-31962
Medium · 4.3
CWE-613 Jan 7, 2026
HCL BigFix IVR is impacted by an insufficient session expiration vulnerability
Insufficient session expiration in the Web UI authentication component in HCL BigFix IVR version 4.2 allows an authenticated attacker to gain prolonged unauthorized access to protected API endpoints due to excessive expiration periods.