Medium severity · published Dec 17, 2025
CVE-2025-59849
HCL BigFix Remote Control is vulnerable to an insecure CSP configuration
6.1
CVSS
0.2%
EPSS
No
On KEV
Description
Improper management of Content Security Policy in HCL BigFix Remote Control Lite Web Portal (versions 10.1.0.0326 and lower) may allow the execution of malicious code in web pages.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BR
BigFix Remote Control · HCL Software
<= 10.1.0.0326 · source: vendor
HD
Hcl Devops Deploy · Hcltechsw
8.0.0.0 before 8.0.1.11; 8.1.0 before 8.1.2.4 · source: NVD
HL
Hcl Launch · Hcltechsw
7.3.0.0 before 7.3.2.16 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-59849
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-59849
Vendor Advisory
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0127332
More from BigFix Remote Control
8.2
CVE-2025-31965
HCL BigFix Remote Control is affected by an authorization bypass vulnerability
4.8
CVE-2025-55254
HCL BigFix Remote Control is vulnerable to a Path-relative stylesheet import (PRSSI)