CVE-2025-31965
HCL BigFix Remote Control is affected by an authorization bypass vulnerability
Improper access restrictions in HCL BigFix Remote Control Server WebUI (versions 10.1.0.0248 and lower) allow non-admin users to view unauthorized information on certain web pages.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
HCL BigFix Remote Control is affected by an authorization bypass vulnerability
Improper access restrictions in HCL BigFix Remote Control Server WebUI (versions 10.1.0.0248 and lower) allow non-admin users to view unauthorized information on certain web pages.
- Record
CVE-2025-31965- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:L - Weakness
- CWE-305
- Updated
- 2026-11-02
EUVDEUVD-2025-23008
Improper access restrictions in HCL BigFix Remote Control Server WebUI (versions 10.1.0.0248 and lower) allow non-admin users to view unauthorized information on certain web pages.
- Record
EUVD-2025-23008- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-hw93-rxq2-mqww
Improper access restrictions in HCL BigFix Remote Control Server WebUI (versions 10.1.0.0248 and...
Improper access restrictions in HCL BigFix Remote Control Server WebUI (versions 10.1.0.0248 and lower) allow non-admin users to view unauthorized information on certain web pages.
- Record
GHSA-hw93-rxq2-mqww- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:L - Weakness
- CWE-305
- Updated
- 2026-11-02
NVD
Improper access restrictions in HCL BigFix Remote Control Server WebUI (versions 10.1.0.0248 and lower) allow non-admin users to view unauthorized information on certain web pages.
- Record
CVE-2025-31965- CVSS 3.1
- 8.2 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:L - Weakness
- CWE-305
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-31965 is a high vulnerability (CVSS 8.2) in Hcl Software Bigfix Remote Control, published July 29, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.23%, the 13th percentile. No source names a fixed version.