Hcl CVE-2025-55275

The risk profile presents a moderate but not critical threat. The CVSS v3.1 base score of 3.7 reflects low severity due to high attack complexity (AC:H), requirement for authenticated user interaction (PR:L, UI:R), and limited scope of impact (confidentiality and availability only, no integrity impact). The SSVC decision framework corroborates this assessment: exploitation is marked as 'none' (no public POC), the vulnerability is not automatable, and technical impact is only partial. The network attack vector (AV:N) and low privilege requirement (PR:L) are noteworthy, but the high complexity barrier and lack of any KEV or public exploit activity suggest this is a lower-priority issue compared to typical admin-level vulnerabilities. Organizations should patch when convenient within normal maintenance windows rather than treating this as an emergency.

An attacker with valid low-privilege credentials logs into HCL Aftermarket DPC from one session. Simultaneously, or immediately after, the attacker initiates a second concurrent session from a different network location or device. Due to improper session concurrency handling, the attacker manipulates session state or timing across these concurrent connections to assume administrative privileges without proper re-authentication. The attack requires user interaction (UI:R) and non-trivial timing or technical manipulation (AC:H), limiting its practical exploitability. No public proof-of-concept code has been identified, suggesting this vulnerability has not yet been weaponized or actively exploited in the wild.