Hcltech Bigfix Mobile vulnerabilities

10 CVEs affecting Hcltech Bigfix Mobile, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-0277, published 2025-10-16.

More from Hcltech.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2023-28012, published 2023-07-27. High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days. HCL BigFix Mobile is vulnerable to a command injection attack. An authenticated attacker could run arbitrary shell commands on the WebUI server.
• CVE-2021-27780, published 2022-05-27. Medium severity, CVSS 5.3. EPSS: 0.8% chance of exploitation in the next 30 days. The software may be vulnerable to both Un-Auth XML interaction and unauthenticated device enrollment.
• CVE-2021-27781, published 2022-05-27. Medium severity, CVSS 4.8. EPSS: 0.4% chance of exploitation in the next 30 days. The Master operator may be able to embed script tag in HTML with alert pop-up display cookie.
• CVE-2021-27783, published 2022-05-25. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. User generated PPKG file for Bulk Enroll may have unencrypted sensitive information exposed.
• CVE-2021-27782, published 2023-01-20. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. HCL BigFix Mobile / Modern Client Management Admin and Config UI passwords can be brute-forced. User should be locked out for multiple invalid attempts.
• CVE-2025-0277, published 2025-10-16. Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days. HCL BigFix Mobile 3.3 and earlier are vulnerable to certain insecure directives within the Content Security Policy (CSP). An attacker could trick users into performing actions by not properly…
• CVE-2025-0276, published 2025-10-16. Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days. HCL BigFix Modern Client Management (MCM) 3.3 and earlier are vulnerable to certain insecure directives within the Content Security Policy (CSP). An attacker could trick users into performing…
• CVE-2025-0275, published 2025-10-16. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. HCL BigFix Mobile 3.3 and earlier is affected by improper access control. Unauthorized users can access a small subset of endpoint actions, potentially allowing access to select internal functions.
• CVE-2025-0274, published 2025-10-16. Medium severity, CVSS 4.3. EPSS: 0.3% chance of exploitation in the next 30 days. HCL BigFix Modern Client Management (MCM) 3.3 and earlier is affected by improper access control. Unauthorized users can access a small subset of endpoint actions, potentially allowing access to…
• CVE-2023-28014, published 2023-07-27. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. HCL BigFix Mobile is vulnerable to a cross-site scripting attack. An authenticated attacker could inject malicious scripts into the application.