Hcl CVE-2025-55271

While the CVSS score of 3.1 appears low-severity, the risk assessment is substantially tempered by multiple factors. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N) reflects high attack complexity and mandatory user interaction, limiting practical exploitability. The CISA SSVC framework concurs: exploitation is marked as none (no active exploitation observed), the attack is not automatable, and technical impact is only partial. Confidentiality impact is limited to low; integrity and availability are unaffected. The combination of high complexity, user interaction requirement, and absence of automatable exploitation vectors indicates this vulnerability presents a low real-world priority for most deployments. Organizations should prioritize patching only after critical and high-severity vulnerabilities are addressed, and only if the affected version (1.0.0) is in active use.

An attacker crafts a malicious URL or form submission containing CRLF characters embedded within a parameter that is echoed into an HTTP response header by Aftermarket DPC. If a victim visits this URL or is socially engineered into submitting the form, the injected CRLF sequences break out of the current header, allowing the attacker to inject arbitrary headers (e.g., Set-Cookie with malicious session tokens) or a second HTTP response body. Depending on how downstream systems (proxies, browsers) handle the split response, the attacker could achieve credential theft or content spoofing; however, high attack complexity and mandatory user interaction significantly limit practical exploitation.