CVE-2025-0275
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
HCL BigFix Mobile 3.3 and earlier have improper access control, allowing unauthorized users to access a small subset of endpoint actions, potentially enabling access to select internal functions.
Risk Assessment
Unauthorized users may gain access to internal functions, potentially leading to unauthorized actions in the environment.
Recommendation
Upgrade HCL BigFix Mobile to the latest version and review/strengthen access controls.
Other vulnerabilities in HCL BigFix Mobile
See all- CVE-2026-56619Medium
HCL BigFix Mobile is vulnerable to Reflected Cross-Site Scripting (Reflected XSS) due to insufficient validation and output encoding of user-controlled input.
- CVE-2026-56620Medium
HCL BigFix Mobile is vulnerable to information disclosure due to improper handling of exceptions and verbose error reporting.
- CVE-2025-0277Medium
HCL BigFix Mobile version 3.3 and earlier have insecure directives within the Content Security Policy (CSP). An attacker could trick users into performing actions by not properly restricting the sources of scripts and other content.
Original NVD description (English source)
HCL BigFix Mobile 3.3 and earlier is affected by improper access control. Unauthorized users can access a small subset of endpoint actions, potentially allowing access to select internal functions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS