EUVD-2025-209669
GHSA-w9jr-wh7w-mh6j
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionCVE.org
HCL BigFix RunBookAI is affected by a Unvalidated Command Input / Potential Command Smuggling vulnerability. A flaw in a component's input handling was identified that could permit unauthorized command execution.
AnalysisAI
Command injection in HCL BigFix RunBookAI 11.2 allows authenticated remote attackers to execute arbitrary operating system commands. The vulnerability stems from unvalidated input handling in a component that processes commands, enabling command smuggling techniques to bypass input validation. HCL has released a vendor advisory (KB0130444) addressing this issue, which poses significant risk given the product's role in IT automation and runbook orchestration across enterprise environments.
Technical ContextAI
HCL BigFix RunBookAI is an IT automation and orchestration platform that executes runbooks and operational procedures across endpoint infrastructure. The vulnerability affects version 11.2 and is classified as CWE-77 (Improper Neutralization of Special Elements used in a Command), commonly known as command injection. This flaw occurs when user-supplied input is passed to system command interpreters without proper sanitization, allowing attackers to append malicious commands using shell metacharacters, command separators, or injection techniques. The affected CPE (cpe:2.3:a:hcl:bigfix_runbookai) indicates the vulnerability resides in the core application rather than a specific module, suggesting the input validation weakness may affect multiple command execution pathways within the automation framework.
RemediationAI
Apply the security update detailed in HCL Knowledge Base article KB0130444 available at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0130444. The vendor advisory provides patch instructions specific to BigFix RunBookAI 11.2 deployments. Until patching is complete, implement compensating controls including restricting network access to the RunBookAI interface to trusted administrative networks only, enforcing strict authentication and authorization policies for RunBookAI users to minimize the credential pool that could exploit this vulnerability, auditing all command execution logs for suspicious patterns or unexpected system calls, and disabling or restricting access to the vulnerable component if operationally feasible. Note that access restrictions will limit automation capabilities and may impact operational workflows, requiring coordination with IT operations teams before implementation.
A Boolean-based SQL injection vulnerability exists in HCL Unica that allows remote attackers to manipulate backend datab
HCL BigFix Service Management (SX) is affected by a Broken Access Control vulnerability leading to privilege escalation.
SQL injection in HCL Aftermarket DPC version 1.0.0 enables unauthenticated remote attackers to extract sensitive databas
Content Security Policy weakness in HCL Hive Telco Observability's Keycloak authentication component allows remote attac
Missing functional level access control in HCL Aftermarket DPC version 1.0.0 enables privilege escalation attacks that c
Hardcoded credentials in HCL Aftermarket DPC version 1.0.0 enable authenticated low-privilege attackers with user intera
HCL Aftermarket DPC version 1.0.0 is vulnerable to unauthenticated file discovery that allows remote attackers to read s
HCL Aftermarket DPC versions up to 1.0.0 are vulnerable to session fixation attacks that enable attackers to hijack user
HCL AION contains inadequate auditing and logging mechanisms that fail to properly track certain user actions, reducing
HCL Aftermarket DPC versions prior to and including 1.0.0 suffer from an unrestricted file upload vulnerability (CWE-434
HCL AION contains a container base image authentication vulnerability where container images are not properly verified b
Session invalidation failure in HCL Aftermarket DPC versions up to 1.0.0 allows authenticated attackers to maintain acti
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today