PT-2026-1576 · Hcl · Hcl Bigfix Ivr

CVE-2025-31963 · Published 2026-01-07 · Updated 2026-01-22

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions HCL BigFix IVR version 4.2

Description The local setup interface component suffers from improper authentication and a lack of CSRF protection. This allows a local attacker to make unauthorized configuration changes by sending unauthenticated administrative configuration requests.

Recommendations Apply updates to address the authentication and CSRF protection issues in the local setup interface component.

Fix

CSRF

Missing Authentication

Weakness Enumeration

CWE-352

CWE-306

Related Identifiers

CVE-2025-31963

Affected Products

Hcl Bigfix Ivr

References · 5

• https://osv.dev/vulnerability/CVE-2025-31963 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-31963 · Security Note
• https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0127753 · Vendor Advisory
• https://t.me/cveNotify/149537 · Telegram Post
• https://twitter.com/CVEnew/status/2008807435377484108 · Twitter Post