CVE-2025-0276— HCL BigFix Modern Client Management (MCM) is affected by an insecure Content Security Policy (CSP)
Quick assessment
Affected
HCL Software BigFix Modern Client Management
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
HCL BigFix Modern Client Management（HCL Technologies BigFix MCM）是印度HCL公司的一种现代客户端管理系统。 HCL BigFix Modern Client Management 3.3及之前版本存在安全漏洞，该漏洞源于内容安全策略中存在不安全指令，可能导致攻击者诱骗用户执行操作。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-0276
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
HCL BigFix Modern Client Management (MCM) is affected by an insecure Content Security Policy (CSP)
Source: CVE Program / CVE List V5
Vulnerability Description
HCL BigFix Modern Client Management (MCM) 3.3 and earlier are vulnerable to certain insecure directives within the Content Security Policy (CSP). An attacker could trick users into performing actions by not properly restricting the sources of scripts and other content.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
保护机制失效
Source: CVE Program / CVE List V5
Vulnerability Title
HCL BigFix Modern Client Management 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
HCL BigFix Modern Client Management（HCL Technologies BigFix MCM）是印度HCL公司的一种现代客户端管理系统。 HCL BigFix Modern Client Management 3.3及之前版本存在安全漏洞，该漏洞源于内容安全策略中存在不安全指令，可能导致攻击者诱骗用户执行操作。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| HCL Software | BigFix Modern Client Management | <=3.3 | - |
|
II. Public POCs for CVE-2025-0276
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-0276
请登录查看更多情报信息。
Same Patch Batch · HCL Software · 2025-10-16 · 5 CVEs total
| CVE-2025-0277 | 6.5 MEDIUM | HCL BigFix Mobile is affected by an insecure Content Security Policy (CSP) |
| CVE-2024-42192 | 5.5 MEDIUM | HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a credential leakage |
| CVE-2025-0275 | 5.3 MEDIUM | HCL BigFix Mobile 3.3 and earlier is affected by improper access control |
| CVE-2025-0274 | 5.3 MEDIUM | HCL BigFix Modern Client Management (MCM) 3.3 and earlier is affected by improper access c |
IV. Related Vulnerabilities
Same vendor: HCL Software
-
CVE-2025-52657
HCL MyXalytics is affected by multiple security vulnerabilit -
CVE-2025-52652
HCL MyXalytics is affected by multiple security vulnerabilit -
CVE-2025-52651
HCL MyXalytics is affected by multiple security vulnerabilit -
CVE-2025-62343
HCL IntelliOps Event Management is affected by multiple secu -
CVE-2025-62342
HCL IntelliOps Event Management is affected by multiple secu
Same weakness: CWE-693
-
CVE-2026-76059
Langflow is vulnerable to arbitrary code execution due to mu -
CVE-2026-45770
Suricata lua: excessive flow variable registration can bypas -
CVE-2026-0306
Prisma Access Agent: EndPoint DLP Bypass Vulnerability on Wi -
CVE-2026-79638
Dell Secure Connect Gateway 处理逻辑错误漏洞 -
CVE-2026-87808
SiYuan before v3.8.2 Read-Only Boundary Bypass via fullTextS
V. Comments for CVE-2025-0276
No comments yet