What is the CVSS score of CVE-2025-55271?

CVE-2025-55271 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Aftermarket Dpc are affected by CVE-2025-55271?

CVE-2025-55271 is a low-severity vulnerability in HCL Aftermarket DPC (CVSS 3.1). The limited severity suggests constrained impact, typically requiring specific conditions or local access for…

How to fix or mitigate CVE-2025-55271?

During next maintenance window: Apply vendor patches when convenient. Monitor vendor channels for updates.

Aftermarket Dpc CVE-2025-55271

EUVD-2025-209065 LOW

HTTP Response Splitting (CWE-113)

2026-03-26 HCL

Code Injection Aftermarket Dpc

3.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.1 LOW

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 26, 2026 - 13:15 euvd

EUVD-2025-209065

Analysis Generated

Mar 26, 2026 - 13:15 vuln.today

CVE Published

Mar 26, 2026 - 12:59 nvd

LOW 3.1

DescriptionCVE.org

HCL Aftermarket DPC is affected by HTTP Response Splitting vulnerability where in depending on how the web application handles the split response, an attacker may be able to execute arbitrary commands or inject harmful content into the response..

AnalysisAI

HTTP Response Splitting in HCL Aftermarket DPC allows unauthenticated remote attackers to inject arbitrary content or commands into HTTP responses, potentially leading to content spoofing or further exploitation depending on application response handling. The vulnerability affects Aftermarket DPC version 1.0.0 and requires user interaction to exploit. No public exploit identified at time of analysis, and exploitation is not currently automatable according to CISA SSVC assessment, resulting in a low real-world risk profile despite the injection vector.

Technical ContextAI

HTTP Response Splitting vulnerabilities arise from improper sanitization of user-controlled input that is incorporated into HTTP response headers, as classified under CWE-113 (Improper Neutralization of CRLF Sequences in HTTP Headers). HCL Aftermarket DPC (identified via CPE cpe:2.3:a:hcl:aftermarket_dpc:*:*:*:*:*:*:*:*) fails to adequately validate or encode data before including it in response headers, permitting an attacker to inject carriage return and line feed characters. This allows an attacker to terminate the current HTTP header block and inject arbitrary headers or even an entirely new HTTP response, potentially enabling cache poisoning, session fixation, or credential theft depending on downstream processing by intermediate proxies or client-side applications.

RemediationAI

Apply the vendor-released patch from HCL by consulting the official security advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129793, which details the exact patched version and upgrade procedure. If immediate patching is not feasible, implement input validation and output encoding controls at the application or web application firewall layer to neutralize CRLF injection attempts in user-supplied parameters that are reflected in HTTP response headers. Additionally, enforce strict HTTP response header validation policies and consider deploying a reverse proxy with header filtering rules to prevent response splitting attacks. Monitor HTTP response headers in production logs for anomalous injection patterns.