CVE-2025-59849

HCL BigFix Remote Control is vulnerable to an insecure CSP configuration

State: Published
Severity: 4.7 Medium
Published: Dec 17, 2025
Updated: Dec 17, 2025
Reserved: Sep 22, 2025

Description

Improper management of Content Security Policy in HCL BigFix Remote Control Lite Web Portal (versions 10.1.0.0326 and lower) may allow the execution of malicious code in web pages.

Scores

CVSS	Score	Vector	Source
3.1	4.7 Medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N	HCL

Weaknesses

CWE-1021 Improper Restriction of Rendered UI Layers or Frames
CWE-693 Protection Mechanism Failure

Affected Products

Product	Versions
BigFix Remote ControlHCL Software	<= 10.1.0.0326Affected

References

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0127332

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.