What is the CVSS score of CVE-2025-55263?

CVE-2025-55263 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Aftermarket Dpc are affected by CVE-2025-55263?

HCL Aftermarket DPC version 1.0.0 contains hardcoded credentials that allow authenticated attackers to extract sensitive secrets and cause complete service outages.

How to fix or mitigate CVE-2025-55263?

Within 24 hours: Audit all deployments of HCL Aftermarket DPC 1.0.0 to identify instances and document user access patterns. Within 7 days: Implement network segmentation to restrict access to the application and rotate any credentials or secrets that may have been exposed through source code or repository access. Within 30 days: Contact HCL for patch availability and timeline; establish a change control process to deploy updates immediately upon release.

Aftermarket Dpc CVE-2025-55263

EUVD-2025-209083 HIGH

Use of Hard-coded Credentials (CWE-798)

2026-03-26 HCL

Information Disclosure Aftermarket Dpc

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 26, 2026 - 13:45 euvd

EUVD-2025-209083

Analysis Generated

Mar 26, 2026 - 13:45 vuln.today

CVE Published

Mar 26, 2026 - 13:05 nvd

HIGH 7.3

DescriptionCVE.org

HCL Aftermarket DPC is affected by Hardcoded Sensitive Data which allows attacker to gain access to the source code or if it is stored in insecure repositories, they can easily retrieve these hardcoded secrets.

AnalysisAI

Hardcoded credentials in HCL Aftermarket DPC version 1.0.0 enable authenticated low-privilege attackers with user interaction to extract sensitive secrets from source code or insecure repositories, resulting in high confidentiality compromise and complete denial of service. CVSS score 7.3 reflects network-accessible attack requiring low privileges and user interaction. No public exploit identified at time of analysis, with SSVC framework indicating no current exploitation and non-automatable attack characteristics.

Technical ContextAI

This vulnerability stems from CWE-798 (Use of Hard-coded Credentials), where sensitive authentication data or cryptographic secrets are embedded directly in the application codebase. The affected product is HCL Aftermarket DPC (cpe:2.3:a:hcl:aftermarket_dpc), specifically version 1.0.0. Hardcoded credentials represent a fundamental security anti-pattern where static secrets in source code can be extracted through reverse engineering, repository access, or binary analysis. Unlike dynamic credential management systems, hardcoded secrets cannot be rotated without code changes and remain persistent across deployments. The vulnerability allows attackers who obtain source code access or discover insecurely stored repositories to retrieve these embedded secrets, potentially including database passwords, API keys, encryption keys, or service account credentials.

RemediationAI

Consult the HCL security advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129793 for vendor-recommended remediation steps and patch availability. Organizations should immediately rotate all credentials that may have been hardcoded in version 1.0.0, implement external credential management systems such as HashiCorp Vault or cloud provider secret managers, and conduct source code audits to identify all embedded secrets. Until patching is completed, restrict network access to Aftermarket DPC instances to trusted IP ranges, enforce principle of least privilege for user accounts, implement comprehensive monitoring for unauthorized access attempts, and secure all source code repositories with access controls and audit logging. Remove any publicly accessible repositories containing the vulnerable code and review commit history for exposed secrets.