EUVD-2025-208737CVSS Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L
Lifecycle Timeline
3Description
HCL AION is affected by a vulnerability where certain user actions are not adequately audited or logged. The absence of proper auditing mechanisms may reduce traceability of user activities and could potentially impact monitoring, accountability, or incident investigation processes.
Analysis
HCL AION contains inadequate auditing and logging mechanisms that fail to properly track certain user actions, reducing the traceability of user activities and potentially compromising monitoring, accountability, and incident investigation capabilities. The vulnerability affects AION 2.0 and is classified as an Information Disclosure issue with a CVSS score of 5.8. An attacker with local access and low privileges could exploit this to perform actions without adequate logging, hindering forensic analysis and compliance audit trails.
Technical Context
The vulnerability exists in HCL AION (cpe:2.3:a:hcl:aion:*:*:*:*:*:*:*:*), a platform affected by insufficient audit logging mechanisms. While no specific CWE is assigned in the disclosure, this type of vulnerability typically falls under CWE-778 (Insufficient Logging) or related audit control weaknesses. The root cause involves the application's failure to implement comprehensive logging for sensitive user operations, meaning certain state-changing actions bypass audit trail generation entirely. This is particularly critical in enterprise governance platforms where audit logs serve as the primary mechanism for compliance, forensic investigation, and regulatory adherence.
Affected Products
HCL AION version 2.0 is confirmed affected by this vulnerability according to ENISA EUVD-2025-208737. The CPE identifier cpe:2.3:a:hcl:aion:*:*:*:*:*:*:*:* indicates the vulnerability may affect multiple versions, though AION 2.0 is explicitly listed in the EUVD disclosure. Organizations running AION should consult the HCL support article KB0129410 at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129410 for detailed version impact assessment and patch availability.
Remediation
Contact HCL support and apply the security patch provided in knowledge base article KB0129410 (https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129410) to restore comprehensive audit logging functionality for all user actions. Until patches are deployed, implement compensating controls such as enabling operating system-level audit logging for AION application processes, deploying endpoint detection and response (EDR) tools to monitor AION process behavior, restricting local login access to trusted administrators only, and implementing file integrity monitoring on AION configuration and database files to detect unauthorized modifications. Configure centralized log aggregation with alerting for any modifications to audit log settings or deletion attempts.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today