CVE-2025-31962: low-severity vulnerability in HCLSoftware BigFix IVR
HCL BigFix IVR is impacted by an insufficient session expiration vulnerability
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
8Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 2epss 0.2%
Insufficient session expiration in the Web UI authentication component in HCL BigFix IVR version 4.2 allows an authenticated attacker to gain prolonged unauthorized access to protected API endpoints due to excessive expiration periods.
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N
Affected products
HCLSoftware · BigFix IVRRelated CVEs — HCLSoftware BigFix IVR
In the same product, most dangerous first.