HCL AION CVE-2025-52625

Exploitation requires that an HCL AION 2.0.0 web session serve HTTPS responses without cache-prevention headers (no-store/no-cache), AND that the attacker already has access to the cached copy - the local browser cache, a shared/kiosk endpoint, a disk/forensic image, or an intermediary caching proxy. Sensitive data (credentials, system identifiers, internal file paths) must actually be present in the cached pages for impact. Key limiting factors: the attacker needs prior access to the device, browser profile, or cache store (not pure remote network access), which sharply narrows realistic exploitation compared to the AV:N rating; no user interaction or authentication to AION is needed once cache access is obtained.

This is a low-real-risk issue despite its 7.5 (High) CVSS score, and the signals conflict in an important way. The published vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/C:H models a remotely reachable, unauthenticated, high-confidentiality breach, but the description itself scopes the threat to 'attackers with access to the device or browser' - i.e., local or shared-device access to cached artifacts, not a network-reachable disclosure. That contradiction means the AV:N and C:H ratings are almost certainly inflated for a CWE-525 (cacheable HTTPS page) weakness; verify scope with HCL. Corroborating the low-risk read: EPSS is 0.03% (9th percentile), the CVE is not on CISA KEV, and no public PoC is referenced. There is no SSVC decision data in the input. Net: treat as a hygiene/defense-in-depth finding to patch on a normal cycle, not an emergency - the headline 7.5 overstates practical exposure.

An attacker who gains access to a user's browser, a shared or kiosk machine, a forensic disk image, or a caching proxy retrieves locally cached HTTPS pages from an HCL AION session and reads credentials, system identifiers, or internal file paths left in the cache. No public exploit code is referenced, and the attack requires prior access to the device or browser rather than remote network interaction, so it is opportunistic post-access data harvesting rather than a primary intrusion vector.