HCL AION CVE-2025-52630
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed AION 2.0 endpoint
-
ExploitSend crafted unauthenticated request
-
ExecutionApplication returns sensitive data
-
ImpactHarvest disclosed information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The description provides no specific precondition - it does not name a feature, protocol, configuration setting, or deployment mode, stating only that HCL AION 2.0 exposes sensitive information to an unauthorized actor. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation requires only network reachability to an AION 2.0 instance with no authentication and no user interaction. The primary limiting factors are therefore deployment-based: the instance must be network-accessible to the attacker, the product is specifically version 2.0, and AION's niche footprint means few environments are affected; note that the vendor-assigned unauthenticated/network characterization is not elaborated in the public advisory and should be confirmed with HCL. |
| Impact | Signals are largely consistent but point to a LOW real-world priority despite the HIGH (7.5) base score. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, unauthenticated, low-complexity information-disclosure flaw, which drives the elevated score purely on confidentiality (C:H, I:N, A:N). However, EPSS is only 0.03% (9th percentile), the vulnerability is NOT listed in CISA KEV, and no public exploit (POC) has been identified - so there is no evidence of active or imminent exploitation. No SSVC decision data was provided in the input. The main caveat is that the description ('Exposure of Sensitive Information to an Unauthorized Actor') is extremely terse and does not substantiate the network, unauthenticated nature of the vector or the C:H magnitude; this rating appears vendor-assigned (psirt@hcl.com) and is not independently corroborated in the public reference. Net: a genuinely network-exposed unauthenticated data leak would warrant prompt patching, but the near-zero EPSS, absence of KEV/POC, and the niche deployment footprint of HCL AION make this a moderate, scheduled-remediation item rather than an emergency. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker who can reach an exposed HCL AION 2.0 instance sends requests that cause the application to return sensitive information it should not disclose (CWE-200), harvesting that data without needing credentials or user interaction. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no special timing or privilege is required, but no public exploit code is currently available to automate the attack. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 08, 2026
Information disclosure in HCL AION 2.0 allows unauthenticated, remote attackers to read sensitive data without user interaction (CVSS 7.5, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). No public exploit code or active exploitation (CISA KEV) has been identified, and the EPSS score is very low at 0.03% (9th percentile), indicating limited real-world targeting despite the high base score. The vendor advisory does not detail the affected feature or protocol, and the product's niche deployment footprint further reduces exposure.
Earlier versions of this analysis (1)
HCL AION 2.0 exposes sensitive information to unauthorized actors via a high-complexity network attack. An unauthenticated attacker can remotely retrieve limited data without user interaction. No public exploit or active exploitation is known, and patch availability is unconfirmed.
RemediationAI
No vendor-released patch is identified in the available data; consult the HCL advisory (https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0124444) for the latest remediation guidance and any patched version. Because the vulnerability is network-reachable and unauthenticated (AV:N/PR:N/UI:N), the primary compensating control is to restrict network access to AION 2.0 instances - place them behind a firewall, VPN, or allow-list so only trusted users can reach the service; the trade-off is reduced remote accessibility for legitimate users. Additionally, enable and review access logs for unexpected data retrieval, and consider disabling any unnecessary endpoints or features if HCL identifies the affected component. Monitor HCL's advisory for a patched release.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is classified under CWE-200, Exposure of Sensitive Information to an Unauthorized Actor, a broad category that can encompass verbose error messages, exposed configuration files, directory traversal, or API responses leaking internal data. The CPE entry cpe:2.3:a:hcltech:aion:2.0.0 confirms that only HCL AION version 2.0 is affected. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates that the flaw is reachable over the network without authentication or user interaction, with a high confidentiality impact but no integrity or availability impact. The public advisory does not identify the specific component, protocol, or precondition involved, so the exact root cause within CWE-200 remains undisclosed; the vendor-assigned unauthenticated/network characterization should be confirmed with HCL.
Know when Aion gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Adopting the vendor vector given the sparse description: network-reachable unauthenticated disclosure (AV:N/PR:N) with confidentiality-only impact (C:H, I:N, A:N); AV/PR unverifiable from text.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HCL AION.This issue affects AION: 2.0.
Executive ViewAI
HCL AION 2.0 contains a high-severity information disclosure flaw that allows unauthenticated remote attackers to read sensitive data without user interaction. Because no vendor-released patch identified at time of analysis, leadership should prioritize locating exposed instances and reducing their network reachability while monitoring for unauthorized data access. The immediate business risk is concentrated in any internet-facing or broadly accessible deployments that store confidential information; no public exploit identified at time of analysis.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting access to HCL AION 2.0 to trusted networks and users, enforcing VPN or zero-trust access, segmenting the product from sensitive data stores, enabling monitoring for anomalous read activity, applying virtual patching or WAF rules where feasible, and contacting HCL for a patch timeline while minimizing sensitive data stored in the product.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)NVD
HCL AION 2.0's Content Security Policy does not enforce Trusted Types for scripts, leaving a browser-level defense-in-de
HCL AION 2.0.0 can leak credentials, system identifiers, and internal file paths through cached HTTPS responses because
HCL AION 2.0 allows unauthenticated remote attackers to access sensitive information due to a CWE-200 information disclo
Session cookies issued by HCL AION 2.0 are set without the Secure attribute (CWE-614), so a network-positioned attacker
Content security policy bypass in HCL AION v2.0 enables inline script injection, allowing remote attackers to modify web
Script allowlist bypass in HCL AION 2.0 allows unauthorized script execution through a misconfigured Content-Security-Po
HCL AION contains inadequate auditing and logging mechanisms that fail to properly track certain user actions, reducing
Insufficient anti-automation controls on certain HCL AION v2.1.0 endpoints allow scripted or automated requests to bypas
HCL AION contains a container base image authentication vulnerability where container images are not properly verified b
Aion versions up to 2.0 is affected by incorrect permission assignment for critical resource (CVSS 5.5).
HCL AION lacks adequate brute-force protections on authentication mechanisms, allowing repeated login attempts that coul
HCL AION fails to enforce encryption for certain data transmissions or operations, potentially exposing sensitive inform
GitHub PoC
Exploit-DB