CVE-2025-31962

LOW

2.0

Description

Insufficient session expiration in the Web UI authentication component in HCL BigFix IVR version 4.2 allows an authenticated attacker to gain prolonged unauthorized access to protected API endpoints due to excessive expiration periods.

CVE Details

CVSS v3.1 Score2.0

SeverityLOW

CVSS VectorCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N

Attack VectorNETWORK

ComplexityHIGH

Privileges RequiredHIGH

User InteractionREQUIRED

Published1/7/2026

Last Modified1/12/2026

Sourcenvd

Honeypot Sightings0

Affected Products

hcltech:bigfix_insights_for_vulnerability_remediation

Weaknesses (CWE)

CWE-613

References

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0127753(psirt@hcl.com)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.