Hcl CVE-2025-55268

The risk profile is moderate but should not be dismissed based on CVSS score alone. The CVSS 4.3 (Low severity) reflects partial availability impact and user interaction requirement; however, multiple signal sources provide context: SSVC assessment indicates no current exploitation (Exploitation: none), the attack is not automatable (Automatable: no), and technical impact is partial. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) confirms remote, unauthenticated, low-complexity attack requiring user interaction-likely a social engineering vector. The absence of POC and KEV designation suggests this is not actively weaponized in the wild. However, the low attack complexity and lack of authentication requirements mean that once a user is deceived into visiting a malicious link, an attacker can execute a sustained DoS with minimal effort. For organizations running Aftermarket DPC in customer-facing or critical environments, this warrants patching; for isolated internal deployments, it is lower priority than vulnerabilities with higher technical impact or autonomous exploitation.

An attacker crafts a malicious web page or email link that, when visited by a user, triggers rapid automated requests to the HCL Aftermarket DPC server (exploiting low attack complexity and no authentication requirement). The requests consume bandwidth and processing resources faster than the application can service legitimate traffic, degrading performance or rendering the service unavailable to other users. Because user interaction is required per the CVSS vector, the attacker must first deceive the target user via social engineering (phishing, malicious advertisement, or compromised website redirect) to visit the attack page; once clicked, the attack executes autonomously. This is a practical low-skill attack suitable for resource-constrained adversaries seeking service disruption.