HCL AION CVE-2025-52632

Exploitation requires the AION 2.0.0 application to be accessible over cleartext HTTP (or downgradable to it) AND the attacker to occupy a man-in-the-middle or passive network-sniffing position on the path between the victim's browser and the server, so the Secure-less cookie is transmitted in plaintext and can be captured. Limiting factors: if AION is deployed strictly over HTTPS with HSTS enforced and no HTTP listener, the cookie is never sent in cleartext and the flaw is effectively unexploitable; the attacker also cannot exploit it remotely without the required network position, which meaningfully constrains real-world risk despite the PR:N/UI:N rating.

This is a textbook moderate-severity hygiene flaw (CWE-614, missing Secure attribute on the session/SSL cookie) whose real-world risk is substantially lower than the headline CVSS 7.5 suggests. The vendor vector (AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:N) treats cookie disclosure as a network-reachable, low-complexity, unauthenticated confidentiality breach, but a missing Secure flag is only exploitable when (a) the application is reachable over cleartext HTTP and (b) an attacker holds a man-in-the-middle or passive network-sniffing position between victim and server - conditions that make AC:L and the resulting high score optimistic; realistically this is AC:H. The corroborating signals all point low: EPSS is 0.02% (5th percentile), there is no CISA KEV listing, and no public exploit code was identified. These are consistent with each other and with the flaw class - this is a configuration/transport-security weakness, not a directly weaponizable RCE. Treat as a routine patch-management item rather than an emergency; prioritize it where AION is exposed over HTTP or on untrusted networks. Note a signal conflict to verify with HCL: CVSS claims AC:L/C:H, but the CWE-614 nature inherently requires a network intercept position, so the effective attack complexity is higher than scored.

An attacker positioned on the same network segment as an AION user (e.g., open Wi-Fi, compromised router, or ARP-spoofing MITM) waits for or induces the victim's browser to issue a request to the AION host over plain HTTP. Because the session cookie lacks the Secure attribute, the browser transmits it in cleartext, letting the attacker capture it and replay it to hijack the authenticated session. No public exploit code is required - standard packet-capture tooling suffices - but success depends on achieving a network intercept position.