HCL BigFix Modern Client Management (MCM) is affected by an insecure Content Security Policy (CSP)
Priority LOW 35CWE-693Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass, Cross-site scripting
- Confidentiality · integrity · availability
- None · Low · Low
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-693 and CWE-79.
Summary
HCL BigFix Modern Client Management (MCM) 3.3 and earlier are vulnerable to certain insecure directives within the Content Security Policy (CSP). An attacker could trick users into performing actions by not properly restricting the sources of scripts and other content.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00305 23rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| HCL Software | BigFix Modern Client Management | up to 3.3 | — | No fix listed | CNA |
- BigFix Modern Client Management VendorHCL Software Affected up to 3.3 Fixed in — No fix listed CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:hcltech:bigfix_mobile:*:*:*:*:*:*:*:* | up to 3.3 | Vulnerable | HCL Software |
| cpe:2.3:a:hcltech:bigfix_modern_client_management:*:*:*:*:*:*:*:* | before 3.4 | Vulnerable | HCL Software |
- cpe:2.3:a:hcltech:bigfix_mobile:*:*:*:*:*:*:*:* Versions up to 3.3 Vulnerable ·HCL Software
- cpe:2.3:a:hcltech:bigfix_modern_client_management:*:*:*:*:*:*:*:* Versions before 3.4 Vulnerable ·HCL Software
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-0276
- 2026-10-03 Alias added: GHSA-mchx-c3f3-4j52
References
More HCL Software Bigfix Mobile vulnerabilities
- TI-2023-12598 HCL BigFix Mobile can be affected by a command injection vulnerability CVSS 3.1HIGH 8.8
- TI-2025-00221 HCL BigFix Mobile is affected by an insecure Content Security Policy (CSP) CVSS 3.1MEDIUM 6.5
- TI-2021-09176 HCL BigFix Mobile / Modern Client Management Server passwords are susceptible to a brute-force attack CVSS 3.1HIGH 7.5
- TI-2025-00219 Missing authentication in HCL Software BigFix Mobile CVSS 3.1MEDIUM 5.3
- TI-2025-00218 Missing authentication in HCL Software BigFix Modern Client Management CVSS 3.1MEDIUM 5.3
- TI-2021-09177 HCL BigFix Mobile / Modern Client Management is vulnerable to sensitive information exposure CVSS 3.1MEDIUM 6.8
Sources
- CVE-2025-0276 · CVE Program
- CVE-2025-0276 · NVD
- FIRST EPSS
- GHSA-mchx-c3f3-4j52 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences