A misconfigured Content Security Policy in the HCL BigFix Remote Control Server WebUI, affecting versions 10.1.0.0442 and earlier, omits fallbacks for certain directives. This omission permits an attacker to bypass the intended restrictions and load resources from unauthorized origins, undermining the protective barrier normally provided by CSP.

The vulnerable component is the BigFix Remote Control Server WebUI from HCL Software. All releases up to and including version 10.1.0.0442 are affected; versions 10.1.0.0443 and later are not listed as vulnerable.

The CVSS score is 4, indicating a low to moderate severity. EPSS data is not available, and the vulnerability is not in the CISA KEV catalog. Exploitation would require access to the WebUI, which might be limited to internal users or exposed services. Since the vulnerability allows loading of arbitrary resources, an attacker with control over the request could potentially introduce malicious scripts into the client-side context, though no direct remote code execution is guaranteed.