HCL Unica CVE-2025-52616

The HCL advisory and description do not name a specific feature, protocol, or configuration flag that must be enabled - the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates remote, unauthenticated exploitation requiring only network reachability to an HCL Unica 12.1.10 instance. The primary limiting factor is exposure: the Unica interface must be network-accessible to the attacker (internet-facing instances are most at risk; those restricted to internal networks or behind VPN/WAF significantly reduce exposure). Impact is confined to information disclosure (I:N/A:N), so this flaw enables reconnaissance for follow-on attacks rather than direct compromise, which limits its standalone severity.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N) scores 7.5 (HIGH) purely on a high-confidentiality impact over the network with no authentication, no user interaction, and low complexity. However, the signals point toward a lower real-world priority: EPSS is only 0.26% (16th percentile), the CVE is NOT on CISA KEV, and no public exploit code was identified. Exploitation status is therefore 'no public exploit identified at time of analysis.' There is a tension worth flagging: the HCL-assigned C:H feels aggressive for a CWE-497 (Exposure of Sensitive System Information) issue whose description only says it 'can expose sensitive system information' used to 'form an attack plan' - that reads as reconnaissance value (enabling follow-on attacks) rather than direct disclosure of high-value secrets, which would typically justify C:L rather than C:H; verify the exact data exposed with HCL. No SSVC decision data was provided. Net assessment: a genuine but lower-tier issue - unauthenticated network-reachable info disclosure is worth patching, but the low EPSS, absence of KEV/POC, and the reconnaissance (not direct-compromise) nature of the leaked data make this a routine-patch priority rather than an emergency.

A remote, unauthenticated attacker sends requests to an internet-reachable HCL Unica 12.1.10 instance and retrieves exposed system information (such as version, configuration, or environment details). The attacker uses that information to fingerprint the deployment and select known vulnerabilities for a follow-on attack. No public proof-of-concept exploit code was identified at the time of analysis.