CVE-2025-31963

Katalog CVE

CVSS 3.3 · Low EPSS 0,09%

Kerentanan Missing Authentication for Critical Function pada hcltech bigfix insights for vulnerability remediation. Skor CVSS 3.1 3.3 (Low) menurut NVD.

Deskripsi (NVD)

Improper authentication and missing CSRF protection in the local setup interface component in HCL BigFix IVR version 4.2 allows a local attacker to perform unauthorized configuration changes via unauthenticated administrative configuration requests.

Rincian

Terbit di NVD

7 Januari 2026

Terakhir diubah

7 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

3.3 (Low), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function
CWE-352: Cross-Site Request Forgery (CSRF)

EPSS (30 hari)

0,09% peluang dieksploitasi; lebih tinggi dari 0,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0127753 advisory vendor