What is the CVSS score of CVE-2025-55261?

CVE-2025-55261 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Aftermarket Dpc are affected by CVE-2025-55261?

HCL Aftermarket DPC version 1.0.0 contains a critical access control flaw that allows unauthenticated attackers to escalate privileges and access or modify sensitive data with minimal user…

How to fix or mitigate CVE-2025-55261?

Within 24 hours: Inventory all systems running HCL Aftermarket DPC 1.0.0 and assess exposure to untrusted network access. Within 7 days: Implement network segmentation to restrict access to the application to authorized users only, and deploy WAF rules to detect and block suspicious privilege escalation attempts targeting the access control mechanism. Within 30 days: Contact HCL for patch availability timelines and evaluate alternative products or temporary decommissioning of the application pending a vendor-released patch.

Aftermarket Dpc CVE-2025-55261

EUVD-2025-209079 HIGH

Improper Access Control (CWE-284)

2026-03-26 HCL

Privilege Escalation Aftermarket Dpc

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 26, 2026 - 13:45 euvd

EUVD-2025-209079

Analysis Generated

Mar 26, 2026 - 13:45 vuln.today

CVE Published

Mar 26, 2026 - 13:10 nvd

HIGH 8.1

DescriptionCVE.org

HCL Aftermarket DPC is affected by Missing Functional Level Access Control which will allow attacker to escalate his privileges and may compromise the application and may steal and manipulate the data.

AnalysisAI

Missing functional level access control in HCL Aftermarket DPC version 1.0.0 enables privilege escalation attacks that can compromise application integrity and confidentiality. Unauthenticated attackers can leverage this access control flaw to manipulate and exfiltrate data with user interaction required (CVSS 8.1, AV:N/AC:L/PR:N/UI:R). No public exploit has been identified at time of analysis, with CISA SSVC rating the technical impact as partial and exploitation status as none.

Technical ContextAI

HCL Aftermarket DPC version 1.0.0 (CPE: cpe:2.3:a:hcl:aftermarket_dpc) suffers from CWE-284 (Improper Access Control), specifically missing functional level access control mechanisms. This vulnerability class occurs when an application fails to validate that users have appropriate authorization before granting access to privileged functions or resources. Unlike authentication bypass which defeats credential checks, functional level access control failures allow authenticated or unauthenticated users to invoke administrative or privileged operations by directly accessing URLs, API endpoints, or application functions that lack proper authorization enforcement at the business logic layer. The CVSS vector indicates network-accessible attack surface (AV:N) with no authentication prerequisite (PR:N), though user interaction is required (UI:R).

RemediationAI

Consult the HCL vendor advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129793 for specific patching guidance and version upgrade instructions. Patch availability details and fixed version numbers are available through the HCL support portal knowledge base article KB0129793. Until patching is completed, implement compensating controls including network segmentation to restrict access to Aftermarket DPC instances to trusted IP ranges, deploy web application firewall rules to monitor and block unauthorized function invocations, enforce strict session management and role-based access controls at infrastructure layers, and implement enhanced logging to detect privilege escalation attempts. Organizations should review audit logs for suspicious administrative function calls from low-privilege or unauthenticated sessions.