HCL DevOps Velocity CVE-2025-31991

The specific prerequisite is network access to the HCL DevOps Velocity login/authentication endpoint on a version below 5.1.7, where the unsuccessful-login-attempt limit is not enforced, allowing unlimited authentication attempts. The attacker must additionally possess or guess valid credentials - the flaw only removes rate limiting, so actual account compromise is limited by password strength, whether the target account exists, and whether MFA is configured (MFA, if enabled, blocks takeover even when guessing succeeds). No special non-default feature toggle is described; the missing enforcement affects the standard login flow. Exploitation is bounded not by CVSS (which claims C:H/I:H/A:H) but by the practical need for weak/guessable passwords, absence of MFA, and lack of external throttling.

The signals conflict and should be reconciled before prioritization. HCL's CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H = 9.8) treats this as full remote compromise, but a rate-limiting weakness does not by itself grant code execution or data access - it only removes a guardrail, and success still depends on weak or guessable passwords and the absence of MFA. CISA SSVC independently rates Exploitation: none, Automatable: no, Technical Impact: partial, and EPSS is 0.02% (7th percentile), all pointing to a much lower real-world urgency. There is no KEV listing and no public exploit identified at time of analysis. Net assessment: this is a defense-in-depth authentication hardening fix, not an emergency RCE; the 9.8 rating appears inflated relative to the described impact (brute-force facilitation) and the corroborating EPSS/SSVC data. Treat as medium priority - patch on a normal cadence and verify with the vendor advisory.

An attacker with network reachability to the Velocity login page runs an automated credential-stuffing or dictionary tool against a known or enumerated username; because the failed-attempt limit is not enforced, the tool can try thousands of passwords without lockout or throttling. Given AV:N/AC:L/PR:N/UI:N, no authentication or user interaction is needed to launch the attempts, and a successful guess yields that user's account access. No public proof-of-concept has been identified at time of analysis.