EUVD-2025-209473
GHSA-p72j-qjhf-94m3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocal access as high-privilege user
-
DeliveryTrigger filesystem behavior enumeration
-
ExploitObserve exposed filesystem paths
-
ExecutionGather reconnaissance intelligence
-
ImpactPlan targeted secondary attack
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Error message sanitization
MITRE ATT&CK
1 technique across 1 tactic: Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS base score of 2.9 aligns with the multiple barriers to exploitation: local-only attack vector, high privilege requirement, user interaction needed, and high complexity. EPSS score and exploitation probability data were not provided, but the absence of public exploits, KEV status, or POC references strongly suggests this is a low real-world priority. The impact is limited to confidentiality (C:L) with no integrity or availability degradation (I:L, A:N), and scope is unchanged (S:U), meaning only the affected resource is impacted. This appears to be a low-risk information disclosure vulnerability useful primarily to attackers already possessing high system privileges and local access-a scenario indicating limited practical exploitability for most organizations. |
| Exploit ScenarioDerived | A malicious insider or compromised high-privilege account holder logs into an HCL AION system locally and triggers specific system behaviors that expose internal filesystem paths and directory structures. By examining these disclosed paths, the attacker gains reconnaissance data about the application's deployment configuration, installed components, and underlying infrastructure layout, which could inform follow-up attacks targeting specific identified services or misconfigurations. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 15, 2026
HCL AION allows local attackers with high privileges to explore internal filesystem structures through certain system behaviors, potentially disclosing information about the underlying environment that could facilitate further targeted attacks. The vulnerability requires local access, high privileges, and user interaction to trigger, with a CVSS score of 2.9 reflecting low immediate risk. No public exploit code or active exploitation has been identified.
RemediationAI
Apply the security patch provided by HCL through the official vendor advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0130007. The advisory should specify the patched version and update process; organizations should prioritize systems where high-privilege users have local access and interactive execution capabilities. Until patching is feasible, restrict local filesystem access and limit high-privilege account usage to authorized administrative personnel only, minimizing the user interaction trigger required for the vulnerability.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability involves information disclosure through filesystem path enumeration or similar disclosure mechanisms in HCL AION (an enterprise integration and optimization platform). The attack surface is limited to local filesystem access (AV:L), requires high privilege levels (PR:H) to trigger, and needs user interaction (UI:R), suggesting the exposure requires deliberate system manipulation rather than accidental mishandling. The low complexity threshold (AC:H) indicates the exploit method is not straightforward. CWE classification was not provided, but the core issue maps to improper access control or information exposure related to filesystem structures.
Know when Hcl gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
HCL AION is affected by a vulnerability where certain system behaviours may allow exploration of internal filesystem structures. Exposure of such information may provide insights into the underlying environment, which could potentially aid in further targeted actions or limited information disclosure.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Information disclosure in HCL Unica Centralized Offer Management allows unauthenticated remote attackers to obtain sensi
SQL injection and cross-tenant data exposure flaws in HCL BigFix Service Management allow an attacker who can reach the
HCL DFXAnalytics 3.1 and earlier ship with outdated third-party libraries or sub-components that carry publicly known vu
A Boolean-based SQL injection vulnerability exists in HCL Unica that allows remote attackers to manipulate backend datab
HCL DFXAnalytics 3.1 and earlier transmit sensitive data across the network without transport encryption, allowing anyon
Command injection in HCL BigFix RunBookAI 11.2 allows authenticated remote attackers to execute arbitrary operating syst
HCL BigFix Service Management (SM) version 23 ships with an outdated, vulnerable WSGI (Web Server Gateway Interface) ser
HCL BigFix Service Management (SX) is affected by a Broken Access Control vulnerability leading to privilege escalation.
SQL injection in HCL Aftermarket DPC version 1.0.0 enables unauthenticated remote attackers to extract sensitive databas
Broken access control in HCL BigFix Service Management lets a low-privileged authenticated user reach administrative scr
Content Security Policy weakness in HCL Hive Telco Observability's Keycloak authentication component allows remote attac
Missing functional level access control in HCL Aftermarket DPC version 1.0.0 enables privilege escalation attacks that c
Exploit-DB