What is the CVSS score of CVE-2025-55269?

CVE-2025-55269 has a CVSS 3.1 base score of 4.2 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of Aftermarket Dpc are affected by CVE-2025-55269?

Organizations using HCL Aftermarket DPC should be aware of moderate risk from CVE-2025-55269 rated CVSS 4.2. Exploitation could compromise the security of affected deployments.

How to fix or mitigate CVE-2025-55269?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Aftermarket Dpc CVE-2025-55269

EUVD-2025-209061 MEDIUM

Weak Password Requirements (CWE-521)

2026-03-26 HCL

Authentication Bypass Aftermarket Dpc

4.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.2 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 26, 2026 - 13:15 euvd

EUVD-2025-209061

Analysis Generated

Mar 26, 2026 - 13:15 vuln.today

CVE Published

Mar 26, 2026 - 13:00 nvd

MEDIUM 4.2

DescriptionCVE.org

HCL Aftermarket DPC is affected by Weak Password Policy vulnerability, which makes it easier for attackers to guess weak passwords or use brute-force techniques to gain unauthorized access to user accounts.

AnalysisAI

HCL Aftermarket DPC version 1.0.0 enforces weak password policies that enable attackers to conduct brute-force attacks and guess user credentials, potentially gaining unauthorized account access with low confidentiality and availability impact. The vulnerability requires user interaction and high attack complexity to exploit, but affects unauthenticated threat actors over the network. No public exploit code or active exploitation has been identified at the time of analysis.

Technical ContextAI

This vulnerability stems from inadequate password policy enforcement in HCL Aftermarket DPC, classified under CWE-521 (Weak Password Policy). The root cause involves insufficient controls on password complexity, length, or entropy requirements during user account creation and credential management. Affected systems (cpe:2.3:a:hcl:aftermarket_dpc:*:*:*:*:*:*:*:*) lack proper validation mechanisms that would enforce strong credential standards, allowing users to set easily guessable passwords. This authentication control gap increases susceptibility to offline dictionary attacks and online brute-force attempts against login interfaces.

RemediationAI

Consult the HCL Software security advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129793 for the exact patched version available. Until patches can be applied, enforce strong password policies at the application level by implementing mandatory password requirements (minimum length of 12+ characters, complexity requirements including uppercase, lowercase, numerals, and special characters) and account lockout mechanisms after failed login attempts. Additionally, implement network-level controls such as IP-based access restrictions, rate limiting on authentication endpoints, and monitoring for brute-force patterns to reduce attack surface while patching schedules are underway.