What is the CVSS score of CVE-2025-52637?

CVE-2025-52637 has a CVSS 3.1 base score of 4.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Aion are affected by CVE-2025-52637?

Organizations using HCL AION should be aware of moderate risk from CVE-2025-52637, a SQL injection vulnerability rated CVSS 4.5.

How to fix or mitigate CVE-2025-52637?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

Aion CVE-2025-52637

EUVD-2025-208720 MEDIUM

SQL Injection (CWE-89)

2026-03-16 HCL

Information Disclosure SQLi Aion

4.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.5 MEDIUM

AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 13:00 euvd

EUVD-2025-208720

Analysis Generated

Mar 16, 2026 - 13:00 vuln.today

CVE Published

Mar 16, 2026 - 12:27 nvd

MEDIUM 4.5

DescriptionCVE.org

HCL AION is affected by a vulnerability where certain offering configurations may permit execution of potentially harmful SQL queries. Improper validation or restrictions on query execution could expose the system to unintended database interactions or limited information exposure under specific conditions.

AnalysisAI

HCL AION contains a SQL injection or improper query validation vulnerability that allows authenticated local users with low privileges to execute potentially harmful SQL queries against the database. The vulnerability affects certain offering configurations and could lead to limited information disclosure, data modification, or denial of service under specific conditions. With a CVSS score of 4.5 and local attack vector requirement, this represents a moderate-risk vulnerability primarily exploitable by insider threats or compromised local accounts.

Technical ContextAI

The vulnerability stems from improper input validation or insufficient access control restrictions on SQL query execution within HCL AION's database interaction layer. This likely represents a CWE-89 (SQL Injection) or CWE-863 (Incorrect Authorization) class flaw where user-supplied input is insufficiently sanitized before being incorporated into SQL queries, or where authorization checks fail to prevent unprivileged users from executing queries beyond their intended scope. The issue is specific to HCL AION's offering configuration modules, suggesting the vulnerability may exist in configuration parsers or query builders that handle user-provided parameters without adequate parameterized query usage or stored procedure enforcement. The local attack vector (AV:L) indicates the attacker must have some form of system access, whether through a compromised account, shell access, or application-level authenticated session.

RemediationAI

Organizations using HCL AION should immediately check the HCL PSIRT advisories and security updates for patch availability targeting this vulnerability and apply updates to affected systems. Until patches are available, implement compensating controls including: enforcing least-privilege database account credentials for AION application processes (use read-only or restricted stored procedures), restricting access to AION offering configuration modules to only required administrative users, implementing database-level query logging and monitoring to detect anomalous SQL execution patterns, and disabling or restricting features that permit user-supplied query parameters if not essential to operations. Network segmentation to limit local system access and multi-factor authentication for administrative accounts can reduce the likelihood of credential compromise that would enable exploitation.