EUVD-2025-209075
GHSA-q4hc-p4wf-w7g4
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Lifecycle Timeline
3Description
HCL Aftermarket DPC is affected by Internal IP Disclosure vulnerability will give attackers a clearer map of the organization’s network layout.
Analysis
HCL Aftermarket DPC version 1.0.0 discloses internal IP addresses to unauthenticated remote attackers via a high-complexity attack vector requiring user interaction, enabling network reconnaissance but causing no direct confidentiality, integrity, or availability impact. No public exploit code has been identified; CISA has not flagged this vulnerability as actively exploited. While the CVSS score of 3.1 (low) reflects minimal immediate risk, the information disclosure enables attackers to map organizational network topology for follow-on attacks.
Technical Context
HCL Aftermarket DPC is a product suite (cpe:2.3:a:hcl:aftermarket_dpc:*:*:*:*:*:*:*:*) affected by an Internal IP Disclosure vulnerability classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The root cause involves improper handling of network information that allows internal IP addresses to be exposed through the application's network interfaces or logging mechanisms. This is a passive information disclosure flaw-the vulnerability itself does not modify data or deny service, but rather leaks structural details of the target organization's infrastructure that would normally remain hidden behind firewalls and NAT boundaries. The exposure occurs in a context requiring network access (AV:N) and high attack complexity (AC:H) combined with user interaction (UI:R), suggesting the vulnerability may be triggered through a phishing or social engineering vector or via conditional logic in the application itself.
Affected Products
HCL Aftermarket DPC version 1.0.0 is confirmed affected per the EUVD data (EUVD-2025-209075). The CPE cpe:2.3:a:hcl:aftermarket_dpc:*:*:*:*:*:*:*:* indicates the vulnerability may affect other versions as well, though only 1.0.0 has been explicitly documented in the EU Vulnerability Database. The HCL vendor security advisory is available at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129793, and the NIST NVD entry is published at https://nvd.nist.gov/vuln/detail/CVE-2025-55276.
Remediation
Upgrade HCL Aftermarket DPC to a patched version released after 1.0.0, following the guidance in the HCL security advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129793. If immediate patching is not feasible, implement compensating controls: restrict network access to the Aftermarket DPC application via firewall rules limiting ingress to trusted administrative ranges, deploy a reverse proxy with request filtering to block requests that trigger the IP disclosure condition, enforce HSTS and Content-Security-Policy headers to reduce user-interaction attack surface, and conduct internal network scanning to verify no internal IP ranges are exposed via the application's error pages or logs. Monitor access logs for anomalous patterns consistent with reconnaissance (repeated requests to different endpoints, error-condition probing). Validate the patch installation by re-testing the conditions described in the advisory to confirm IP disclosure no longer occurs.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today