Low 3.7Published Dec 17, 2025

CVE-2025-55254HCL BigFix Remote Control is vulnerable to a Path-relative stylesheet import (PRSSI)

Updated under an hour ago (Oct 27, 2026, 9:40 AM ET)

Does this affect you?

It affects HCL Software BigFix Remote Control and 2 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for HCL Software BigFix Remote Control

Exploited in the last 30 days

Improper management of Path-relative stylesheet import in HCL BigFix Remote Control Lite Web Portal (versions 10.1.0.0326 and lower) may allow to execute malicious code in certain web pages.

CVSS: 3.7 LOW (v3.1, CNA)CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness (CWE): CWE-601
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: HCL
NVD analysis: Analyzed
Record last updated: Dec 18, 2025
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

HCL Software BigFix Remote Control hcl_software:bigfix_remote_control (from the name)	through 10.1.0.0326	CNA record
hcltechsw hcl_devops_deploy hcltechsw:hcl_devops_deploy	from 8.0.0.0 before 8.0.1.11; from 8.1.0 before 8.1.2.4	NVD
hcltechsw hcl_launch hcltechsw:hcl_launch	from 7.3.0.0 before 7.3.2.16	NVD

References

References

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0127332	vendor-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.