CVE-2025-31963: Hcltech Bigfix Insights For Vulnerability Remediation

Low severity, CVSS 3.3. EPSS: 0.1% chance of exploitation in the next 30 days.

Improper authentication and missing CSRF protection in the local setup interface component in HCL BigFix IVR version 4.2 allows a local attacker to perform unauthorized configuration changes via unauthenticated administrative configuration requests.

Affected products

• Hcltech Bigfix Insights For Vulnerability Remediation: version 4.2 only

Published 2026-01-07. Last modified 2026-10-07.