What is the CVSS score of CVE-2025-55262?

CVE-2025-55262 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H. EPSS exploitation probability: 0.0%.

Which versions of Aftermarket Dpc are affected by CVE-2025-55262?

HCL Aftermarket DPC version 1.0.0 contains an unauthenticated SQL injection vulnerability that allows remote attackers to access sensitive database information without credentials.

How to fix or mitigate CVE-2025-55262?

Within 24 hours: Identify all systems running HCL Aftermarket DPC 1.0.0 and document their network location and data sensitivity classification. Within 7 days: Implement network segmentation to restrict database access and deploy SQL injection filtering rules on web application firewalls protecting affected instances. Within 30 days: Contact HCL for patch availability and timeline; evaluate migration to alternative solutions if patches remain unavailable, or disable the affected application pending remediation.

Aftermarket Dpc CVE-2025-55262

EUVD-2025-209081 HIGH

Use of Hard-coded Credentials (CWE-798)

2026-03-26 HCL

GHSA-2g37-4q7v-m5xx

SQLi Aftermarket Dpc

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 26, 2026 - 13:45 euvd

EUVD-2025-209081

Analysis Generated

Mar 26, 2026 - 13:45 vuln.today

CVE Published

Mar 26, 2026 - 13:07 nvd

HIGH 8.3

DescriptionCVE.org

HCL Aftermarket DPC is affected by SQL Injection which allows attacker to exploit this vulnerability to retrieve sensitive information from the database.

AnalysisAI

SQL injection in HCL Aftermarket DPC version 1.0.0 enables unauthenticated remote attackers to extract sensitive database contents and potentially compromise data integrity and availability. The vulnerability carries a CVSS score of 8.3 with network-based attack vector requiring user interaction. No public exploit is identified at time of analysis, and SSVC assessment indicates no current exploitation with non-automatable attack characteristics.

Technical ContextAI

HCL Aftermarket DPC version 1.0.0 (cpe:2.3:a:hcl:aftermarket_dpc:*:*:*:*:*:*:*:*) contains a SQL injection vulnerability allowing database manipulation through unsanitized user input. Interestingly, the CVE description maps to CWE-798 (Use of Hard-coded Credentials) rather than the expected CWE-89 (SQL Injection), suggesting the attack vector may involve exploiting static credentials to facilitate SQL injection attacks. The discrepancy between the described SQL injection and the assigned CWE-798 indicates this may be a compound vulnerability where hard-coded credentials enable subsequent SQL injection exploitation. The product appears to be a dealer parts commerce platform handling aftermarket automotive or industrial parts inventory and transaction data.

RemediationAI

Consult the HCL vendor security advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129793 for official patch guidance and upgrade instructions. While specific patched version numbers are not confirmed in available intelligence, the vendor advisory should provide remediation steps and updated software releases. Until patching is completed, implement defense-in-depth controls including restricting network access to the DPC platform to trusted IP ranges only, deploying web application firewall rules to detect and block SQL injection attempts, enforcing parameterized queries and input validation at the application layer if source code access permits, and monitoring database query logs for suspicious activity. Given the CWE-798 classification suggesting hard-coded credentials, also review and rotate any static authentication credentials used by the application.