BaseFortify

Publication date: 2025-10-16

Last updated on: 2025-10-21

Assigner: HCL Software

Description

HCL BigFix Modern Client Management (MCM) 3.3 and earlier is affected by improper access control. Unauthorized users can access a small subset of endpoint actions, potentially allowing access to select internal functions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-16

Last Modified

2025-10-21

Generated

2026-07-06

AI Q&A

2025-10-16

EPSS Evaluated

2026-07-05

NVD

CVE-2025-0274

EUVD

EUVD-2025-34712

Affected Vendors & Products

Vendor	Product	Version / Range
hcltech	bigfix_mobile	to 3.3 (inc)
hcltech	bigfix_modern_client_management	to 3.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability in HCL BigFix Modern Client Management (MCM) 3.3 and earlier involves improper access control, which allows unauthorized users to access a limited set of endpoint actions and some internal functions that should be restricted.

Impact Analysis

The impact of this vulnerability is that unauthorized users could perform certain endpoint actions or access select internal functions, potentially leading to limited disruption or unauthorized activity on affected systems. However, it does not affect confidentiality or integrity, only availability to a limited extent.

Hi! I’m here to help you understand CVE-2025-0274. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70