Hcl CVE-2025-55263

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H) indicates network-accessible exploitation with low complexity, requiring low privileges and user interaction, resulting in high confidentiality and availability impact but no integrity impact. SSVC framework assessment shows exploitation status as none, non-automatable attack, and partial technical impact, suggesting lower immediate priority despite moderate CVSS score. The requirement for both low-level authentication (PR:L) and user interaction (UI:R) reduces exploitability compared to unauthenticated vulnerabilities. No public exploit identified at time of analysis and SSVC indicates no active exploitation, lowering real-world urgency. However, the fundamental nature of hardcoded credentials means persistent risk until code is remediated. The 7.3 CVSS score appropriately reflects serious risk for authenticated insiders or attackers who have compromised low-privilege accounts, but practical exploitation requires either source code access or repository compromise, limiting attack surface compared to purely remote vulnerabilities.

An attacker with low-privilege authenticated access to HCL Aftermarket DPC tricks a legitimate user into performing an action that exposes the application source code or repository location through social engineering or phishing. The attacker then accesses the source code repository, extracts hardcoded database credentials or API keys embedded in configuration files or application code, and uses these secrets to directly access backend systems, achieving high confidentiality compromise by exfiltrating sensitive data and causing denial of service by disrupting database availability or locking accounts.