HCLSoftware Vulnerabilities and Affected Products
Vulnerabilities associated with BigFix IVR.
Products
Clear product- Aftermarket EPC14 vulnerabilities
- MyCloud7 vulnerabilities
- Connections6 vulnerabilities
- DevOps Loop4 vulnerabilities
- IntelliOps Event Management4 vulnerabilities
- BigFix IVR3 vulnerabilities
- HCL DevOps Deploy / HCL Launch3 vulnerabilities
- Traveler for Microsoft Outlook3 vulnerabilities
- BigFix Platform2 vulnerabilities
- BigFix Service Management (SM)2 vulnerabilities
- BigFix WebUI2 vulnerabilities
- DevOps Plan2 vulnerabilities
- DFXServer2 vulnerabilities
- Digital Experience2 vulnerabilities
- HCL BigFix Mobile2 vulnerabilities
- Traveler2 vulnerabilities
- BigFix Cloud Lifecycle Management1 vulnerability
- BigFix Compliance1 vulnerability
- BigFix Remote Control Server1 vulnerability
- BigFix SCM Reporting1 vulnerability
- Commerce1 vulnerability
- DevOps Deploy1 vulnerability
- DFMPro for CATIA1 vulnerability
- DFXAnalytics1 vulnerability
- Digital Experience & DX Compose1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
HCL BigFix IVR is impacted by an improper service binding configurationImproper service binding configuration in internal service components in HCL BigFix IVR version 4.2 allows a privileged attacker to impact service availability via exposure of administrative services bound to external network interfaces instead of the local authentication interface. | CVSS2.2v3.1 | EPSS0.324% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
HCL BigFix IVR is impacted by improper authentication and missing CSRF protectionImproper authentication and missing CSRF protection in the local setup interface component in HCL BigFix IVR version 4.2 allows a local attacker to perform unauthorized configuration changes via unauthenticated administrative configuration requests. | CVSS2.9v3.1 | EPSS0.085% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
HCL BigFix IVR is impacted by an insufficient session expiration vulnerabilityInsufficient session expiration in the Web UI authentication component in HCL BigFix IVR version 4.2 allows an authenticated attacker to gain prolonged unauthorized access to protected API endpoints due to excessive expiration periods. CWE-613Jan 7, 2026 | CVSS2.0v3.1 | EPSS0.161% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |