CVE-2025-0277

HCL BigFix Mobile 3.3 and earlier are vulnerable to certain insecure directives within the Content Security Policy (CSP). An attacker could trick users into performing actions by not properly restricting the sources of scripts and other content.

CVSS 3.1

6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.3% chance of exploitation in the next 30 days; higher than 23% of CVEs (scores of 2026-10-25)

CWEs

CWE-79, CWE-80, CWE-693

Published

2025-10-16

Modified

2026-10-08

Record from

the NVD, synced 2026-10-19

Affected

• hcltech:bigfix_mobile
• hcltech:bigfix_modern_client_management

References

• https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124513

Check your stackJSON