CVE-2025-59849 MEDIUM

CVE-2025-59849: HCL BigFix Remote Control is vulnerable to an insecure CSP configuration

Vendor Hcl Software

Product BigFix Remote Control

Weakness CWE-1021

Published December 17, 2025

Last update December 17, 2025

View on NVD All CVEs

CVSS base score

4.7/10

Attack vector Network

Attack complexity High

Privileges required None

User interaction Required

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

Improper management of Content Security Policy in HCL BigFix Remote Control Lite Web Portal (versions 10.1.0.0326 and lower) may allow the execution of malicious code in web pages.

Key dates

02Disclosure timeline

December 17, 2025 CVE published

December 17, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-59849 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/1021.html

Related vulnerabilities

CVE-2025-59849: HCL BigFix Remote Control is vulnerable to an insecure CSP configuration

01Description

02Disclosure timeline

03References

04Related CVE