This vulnerability arises from an improperly configured Content Security Policy in HCL BigFix Remote Control Server WebUI (<= 10.1.0.0442). The CSP does not strictly define directives without fallbacks, allowing attackers with high privileges and user interaction to circumvent security controls and load unauthorized content. The CVSS vector indicates network attack vector, high attack complexity, high privileges required, user interaction needed, and a scope change with low confidentiality and integrity impact but no availability impact.

An attacker with high privileges and requiring user interaction could bypass the CSP restrictions to load unauthorized resources, potentially leading to limited confidentiality and integrity impacts. There is no indication of availability impact or widespread exploitation. The vulnerability could allow unauthorized content to be rendered in the WebUI, possibly facilitating further attacks or information disclosure within the scope of the affected system.

No official patch or remediation is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is provided, organizations should consider restricting access to the affected versions and monitor for any updates from HCLSoftware regarding this vulnerability.