CVE-2025-31964

HCL BigFix IVR is impacted by an improper service binding configuration

State: Published
Severity: 2.2 Low
Published: Jan 7, 2026
Updated: Jan 7, 2026
Reserved: Apr 1, 2025

Description

Improper service binding configuration in internal service components in HCL BigFix IVR version 4.2 allows a privileged attacker to impact service availability via exposure of administrative services bound to external network interfaces instead of the local authentication interface.

Scores

CVSS	Score	Vector	Source
3.1	2.2 Low	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L	HCL

Weaknesses

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-419 Unprotected Primary Channel

Affected Products

Product	Versions
BigFix IVRHCLSoftware	4.2Affected

References

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0127753

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.