HCL AION CVE-2025-52634

The vulnerability affects HCL AION version 2.0 (CPE 2.0.0) and, per the CVSS vector (AV:N/AC:L/PR:N/UI:N), requires only network reachability to the AION instance - no authentication, no user interaction, and no special configuration are indicated by the available data. The primary limiting factors are therefore deployment-based rather than technical: the AION instance must be network-reachable by the attacker (exposure is far lower for instances restricted to internal networks or behind access controls), and only version 2.0 is listed as affected. The NVD description does not specify a required feature, protocol, or non-default setting, so no feature-gated precondition can be confirmed from the provided data; the exact exposure mechanism should be verified against HCL advisory KB0124444.

The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N) indicates a network-reachable, low-complexity, unauthenticated information-disclosure flaw with high confidentiality impact and no integrity or availability impact - consistent with the CWE-200 classification. However, exploitation-likelihood signals strongly temper this severity: the EPSS score is only 0.03% (9th percentile), the CVE is NOT listed in CISA KEV, and no public exploit code was identified in the provided intelligence. The sole reference is the HCL vendor advisory (KB0124444), and no SSVC decision data, POC, or active-exploitation evidence was supplied. These signals are consistent rather than conflicting: a genuinely unauthenticated remote data-exposure bug, but with no evidence of real-world exploitation and a product (HCL AION) that has a small deployment footprint. Net assessment: this is a legitimate high-severity confidentiality issue that AION operators should patch, but it is not a widespread exploitation priority - treat it as important-for-affected-deployments rather than an emergency across the broader estate. Key limitation: the NVD description is extremely sparse ('Exposure of Sensitive Information'), giving no detail on WHICH data is exposed or via what mechanism, so the real impact depends on vendor specifics - verify against HCL advisory KB0124444.

A remote, unauthenticated attacker sends requests to an internet-reachable HCL AION 2.0 instance and retrieves sensitive information that should not be accessible without authorization. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials, user interaction, or special timing are needed, making the request trivial to repeat. No public proof-of-concept exploit was identified at the time of analysis, so the exact disclosed data and endpoint must be confirmed from the HCL advisory.