CVE-2025-31962

MediumCVSS 4.3/10Last modified Oct 7, 2026

Description

Insufficient session expiration in the Web UI authentication component in HCL BigFix IVR version 4.2 allows an authenticated attacker to gain prolonged unauthorized access to protected API endpoints due to excessive expiration periods.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-613

Affected software

Vendor	Product	Versions
HCLSoftware	BigFix IVR	4.2

References

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0127753Vendor Advisory

Timeline

Published: Jan 7, 2026
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-319633.3Improper authentication and missing CSRF protection in the local setup interface component in HCL BigFix IVR version 4.2 allows a local atta CVE-2025-319644.9Improper service binding configuration in internal service components in HCL BigFix IVR version 4.2 allows a privileged attacker to impact s CVE-2025-319658.2Improper access restrictions in HCL BigFix Remote Control Server WebUI (versions 10.1.0.0248 and lower) allow non-admin users to view unauth CVE-2025-319662.7HCL Sametime is vulnerable to broken server-side validation. While the application performs client-side input checks, these are not enforced CVE-2025-319696.1HCL Unica Platform is impacted by misconfigured Content Security Policy (CSP). These can result in malicious resources getting loaded and b CVE-2025-31977.3Versions of the package expand-object from 0.0.0 are vulnerable to Prototype Pollution in the expand() function in index.js. This function e CVE-2025-319706.1HCL DFXAnalytics is affected by an Insecure Security Header configuration vulnerability where the Content-Security-Policy does not define st CVE-2025-319715.1AIML Solutions for HCL SX is vulnerable to a URL validation vulnerability. The issue may allow attackers to launch a server-side request fo CVE-2025-319726.5HCL BigFix SM is affected by a Sensitive Information Exposure vulnerability where internal connections do not use TLS encryption which could CVE-2025-319739.8HCL BigFix Service Management (SM) is susceptible to a Configuration – 'Insecure Use of Base Image Version'. Using outdated or insecure bas CVE-2025-319747.2HCL BigFix Service Management (SM) is susceptible to a Root File System Not Mounted as Read-Only. An improperly configured root file system CVE-2025-319755.3HCL BigFix Service Management (SM) is affected by an Information Disclosure – Server Banner issue was identified. Exposed server banners may