VulnerabilityAnalyzed

CVE-2025-0277

HCL BigFix Mobile 3.3 and earlier are vulnerable to certain insecure directives within the Content Security Policy (CSP).

MEDIUM 6.1EPSS 0.29%

Does this matter?

Lower severity and a low EPSS score (0.29%). Track it; it rarely justifies an emergency change on its own.

Description

HCL BigFix Mobile 3.3 and earlier are vulnerable to certain insecure directives within the Content Security Policy (CSP). An attacker could trick users into performing actions by not properly restricting the sources of scripts and other content.

CVSS 3.1: 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS: 0.29% probability · 21th percentile
CISA KEV: Not listed
Weakness: CWE-79, CWE-80, CWE-693
Affected: hcltech/bigfix mobile · hcltech/bigfix modern client management
Source: psirt@hcl.com

References

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124513Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.