CVE-2025-0277: HCL BigFix Mobile is affected by an insecure Content Security Policy (CSP)
Published Oct 16, 2025
·Updated
HCL BigFix Mobile 3.3 and earlier are vulnerable to certain insecure directives within the Content Security Policy (CSP). An attacker could trick users into performing actions by not properly restricting the sources of scripts and other content.
Affected Software
3 affected components
HCL BigFix Mobile<3.3
hcltech Bigfix Mobile<=3.3
hcltech Bigfix Modern Client Management<3.4
Event History
Oct 16, 2025
CVE Published
via MITRE·08:27 AM
Data Sourced
via MITRE·08:27 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·09:15 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-0277?
CVE-2025-0277 is classified as a moderate severity vulnerability.
2
How do I fix CVE-2025-0277?
To fix CVE-2025-0277, update HCL BigFix Mobile to version 3.4 or later.
3
What causes the CVE-2025-0277 vulnerability?
CVE-2025-0277 is caused by insecure directives within the Content Security Policy that fail to restrict sources adequately.
4
Who is affected by CVE-2025-0277?
CVE-2025-0277 affects users of HCL BigFix Mobile versions 3.3 and earlier.
5
What type of attacks can exploit CVE-2025-0277?
CVE-2025-0277 can be exploited by attackers to execute unauthorized scripts or content, potentially tricking users into performing unintended actions.