EUVD-2025-208743Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2021 - Broken Access Control
ASVS 5.0
V4 - Access Control Authorization enforcement, RBAC validation
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | Exposed information (credentials, internal paths, user data, configuration) can be leveraged for further attacks or regulatory violations. With a CVSS score of 1.8 (LOW), this represents a low risk. |
| Exploit ScenarioDerived | An attacker triggers error conditions or accesses improperly protected endpoints to extract sensitive internal information from the application. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 16, 2026
HCL AION is affected by a vulnerability where certain identifiers may be predictable in nature.
Earlier versions of this analysis (1)
RemediationAI
Implement proper access controls. Sanitize error messages in production. Review logging practices to avoid capturing sensitive data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Information disclosure occurs when an application inadvertently reveals sensitive data to unauthorized actors through error messages, logs, or improper access controls.
Know when Hcl gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
HCL AION is affected by a vulnerability where certain identifiers may be predictable in nature. Predictable identifiers may allow an attacker to infer or guess system-generated values, potentially leading to limited information disclosure or unintended access under specific conditions.
Executive ViewAI
CVE-2025-52649 is a low-severity vulnerability in HCL AION involving information exposure (CVSS 1.8). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation. Apply vendor updates when available as part of routine maintenance.
Apply vendor patch during routine maintenance. Standard information disclosure mitigations apply if patching is delayed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in HCL AION Multiple Security Vulnerabilities
View all 7Information disclosure in HCL Unica Centralized Offer Management allows unauthenticated remote attackers to obtain sensi
SQL injection and cross-tenant data exposure flaws in HCL BigFix Service Management allow an attacker who can reach the
HCL DFXAnalytics 3.1 and earlier ship with outdated third-party libraries or sub-components that carry publicly known vu
A Boolean-based SQL injection vulnerability exists in HCL Unica that allows remote attackers to manipulate backend datab
HCL DFXAnalytics 3.1 and earlier transmit sensitive data across the network without transport encryption, allowing anyon
Command injection in HCL BigFix RunBookAI 11.2 allows authenticated remote attackers to execute arbitrary operating syst
HCL BigFix Service Management (SM) version 23 ships with an outdated, vulnerable WSGI (Web Server Gateway Interface) ser
HCL BigFix Service Management (SX) is affected by a Broken Access Control vulnerability leading to privilege escalation.
SQL injection in HCL Aftermarket DPC version 1.0.0 enables unauthenticated remote attackers to extract sensitive databas
Broken access control in HCL BigFix Service Management lets a low-privileged authenticated user reach administrative scr
Content Security Policy weakness in HCL Hive Telco Observability's Keycloak authentication component allows remote attac
Missing functional level access control in HCL Aftermarket DPC version 1.0.0 enables privilege escalation attacks that c
GitHub PoC
Exploit-DB