CVE-2025-0277: HCL Software BigFix Mobile · Protection Mechanism Failure
Affects HCL Software BigFix MobileSource CVE Database V5
Not known to be exploited · CVSS 6.5 Medium.
Data as of 26 Oct 2026, 17:16 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 23% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:LExploitation evidence
Disclosed: evidence found.
CVE published 16 Oct 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| HCL Software BigFix Mobile | Affected
| Fixed in– |
AI-suggested
- Immediately review and tighten Content Security Policy configurations within BigFix Mobile environments to restrict script and content sources to trusted domains only.
- Monitor HCL’s official channels for patches or updates addressing CVE-2025-0277 and apply them promptly once released.
- Employ web application firewalls (WAFs) or endpoint security solutions capable of detecting and blocking suspicious script injections or anomalous content loading.
- Conduct regular security assessments and penetration testing focused on CSP effectiveness and XSS vulnerabilities in BigFix Mobile deployments.
- Educate administrators and users about the risks of CSP misconfigurations and the importance of cautious interaction with unexpected content or links.
- Implement network segmentation and access controls to limit exposure of BigFix Mobile management interfaces to trusted networks only.
- Maintain comprehensive logging and monitoring to detect unusual activities that may indicate exploitation attempts.
Description
HCL BigFix Mobile 3.3 and earlier are vulnerable to certain insecure directives within the Content Security Policy (CSP). An attacker could trick users into performing actions by not properly restricting the sources of scripts and other content.