Medium severity · published Oct 16, 2025
CVE-2025-0277
HCL BigFix Mobile is affected by an insecure Content Security Policy (CSP)
6.1
CVSS
0.3%
EPSS
No
On KEV
Description
HCL BigFix Mobile 3.3 and earlier are vulnerable to certain insecure directives within the Content Security Policy (CSP). An attacker could trick users into performing actions by not properly restricting the sources of scripts and other content.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BM
BigFix Mobile · HCL Software
<=3.3 · source: vendor, NVD
BM
Bigfix Modern Client Management · Hcltech
before 3.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-0277
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-0277
Vendor Advisory
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124513
More from BigFix Mobile
4.3
CVE-2025-0275
HCL BigFix Mobile 3.3 and earlier is affected by improper access control