CVE-2025-0277
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
HCL BigFix Mobile version 3.3 and earlier have insecure directives within the Content Security Policy (CSP). An attacker could trick users into performing actions by not properly restricting the sources of scripts and other content.
Risk Assessment
An attacker could exploit CSP weaknesses to conduct cross-site scripting attacks or trick users into unwanted actions, potentially leading to security breaches.
Recommendation
Update HCL BigFix Mobile to a version newer than 3.3 and configure a strict CSP policy.
Other vulnerabilities in HCL BigFix Mobile
See all- CVE-2026-56619Medium
HCL BigFix Mobile is vulnerable to Reflected Cross-Site Scripting (Reflected XSS) due to insufficient validation and output encoding of user-controlled input.
- CVE-2026-56620Medium
HCL BigFix Mobile is vulnerable to information disclosure due to improper handling of exceptions and verbose error reporting.
- CVE-2025-0275Medium
HCL BigFix Mobile 3.3 and earlier have improper access control, allowing unauthorized users to access a small subset of endpoint actions, potentially enabling access to select internal functions.
Original NVD description (English source)
HCL BigFix Mobile 3.3 and earlier are vulnerable to certain insecure directives within the Content Security Policy (CSP). An attacker could trick users into performing actions by not properly restricting the sources of scripts and other content.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS