CVE-2025-31965

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

Improper access restrictions in HCL BigFix Remote Control Server WebUI (versions 10.1.0.0248 and lower) allow non-admin users to view unauthorized information on certain web pages.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:L

Weakness enumeration

CWE-305

Affected software

VendorProductVersions
HCL SoftwareBigFix Remote Control<=10.1.0.0248

References

Timeline

Published
Jul 29, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-319662.7HCL Sametime is vulnerable to broken server-side validation. While the application performs client-side input checks, these are not enforcedCVE-2025-319696.1HCL Unica Platform is impacted by misconfigured Content Security Policy (CSP). These can result in malicious resources getting loaded and bCVE-2025-31977.3Versions of the package expand-object from 0.0.0 are vulnerable to Prototype Pollution in the expand() function in index.js. This function eCVE-2025-319706.1HCL DFXAnalytics is affected by an Insecure Security Header configuration vulnerability where the Content-Security-Policy does not define stCVE-2025-319715.1AIML Solutions for HCL SX is vulnerable to a URL validation vulnerability.  The issue may allow attackers to launch a server-side request foCVE-2025-319726.5HCL BigFix SM is affected by a Sensitive Information Exposure vulnerability where internal connections do not use TLS encryption which couldCVE-2025-319739.8HCL BigFix Service Management (SM) is susceptible to a Configuration – 'Insecure Use of Base Image Version'. Using outdated or insecure basCVE-2025-319747.2HCL BigFix Service Management (SM) is susceptible to a Root File System Not Mounted as Read-Only. An improperly configured root file system CVE-2025-319755.3HCL BigFix Service Management (SM) is affected by an Information Disclosure – Server Banner issue was identified. Exposed server banners mayCVE-2025-319767.5HCL BigFix Service Management (SM) is vulnerable to insufficiently protected credentials for a short duration while communicating with a bacCVE-2025-319776.5HCL BigFix SM is affected by cryptographic weakness due to weak or outdated encryption algorithms.  An attacker with network access could exCVE-2025-319784.3HCL BigFix Service Management (SM) does not adequately sanitize or safely render spreadsheet files (CSV, XLS, XLSX) before processing or dis
CVE-2025-31965: High severity, CVSS 8.2 | Vulnix