What is the CVSS score of CVE-2025-55272?

CVE-2025-55272 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Aftermarket Dpc are affected by CVE-2025-55272?

CVE-2025-55272 is a low-severity vulnerability in HCL Aftermarket DPC involving information exposure (CVSS 3.1).

How to fix or mitigate CVE-2025-55272?

During next maintenance window: Apply vendor patches when convenient. Verify information disclosure controls are in place.

Aftermarket Dpc CVE-2025-55272

EUVD-2025-209067 LOW

Information Exposure (CWE-200)

2026-03-26 HCL

GHSA-9hpr-m4wx-q284

Information Disclosure Aftermarket Dpc

3.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.1 LOW

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 26, 2026 - 13:15 euvd

EUVD-2025-209067

Analysis Generated

Mar 26, 2026 - 13:15 vuln.today

CVE Published

Mar 26, 2026 - 12:55 nvd

LOW 3.1

DescriptionCVE.org

HCL Aftermarket DPC is affected by Banner Disclosure vulnerability where attackers gain insights into the system’s software and version details which would allow them to craft software specific attacks.

AnalysisAI

HCL Aftermarket DPC discloses sensitive system and software version information through banner responses, enabling attackers to enumerate deployed instances and tailor version-specific exploits. Aftermarket DPC version 1.0.0 is confirmed affected. The vulnerability requires user interaction and high attack complexity but results in partial confidentiality loss; no public exploit has been identified at the time of analysis.

Technical ContextAI

The vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and manifests as a banner disclosure flaw in HCL Aftermarket DPC (cpe:2.3:a:hcl:aftermarket_dpc:*:*:*:*:*:*:*:*). Banner disclosure vulnerabilities occur when application responses, error messages, or HTTP headers leak version strings, server identification, or other implementation details. In this case, HCL Aftermarket DPC exposes software identification and version metadata to unauthenticated, remote attackers, which can be passively harvested during reconnaissance phases. This information disclosure does not directly enable code execution or system compromise but significantly reduces the attack surface uncertainty that normally protects obscure or patched systems.

RemediationAI

Apply the security patch provided by HCL as documented in KB0129793 (https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129793). If immediate patching is not feasible, implement network-level mitigations by restricting remote access to HCL Aftermarket DPC management interfaces to trusted IP ranges and authenticated networks only. Deploy reverse proxy headers to suppress banner disclosure (e.g., remove Server and X-Powered-By headers), and enforce HTTPS with strong TLS configurations to prevent passive enumeration. Monitor logs for reconnaissance attempts targeting version information endpoints.