EUVD-2025-209661
GHSA-2rh5-wmhh-6qgc
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionCVE.org
HCL DFXAnalytics is affected by a Using Components with Known Vulnerabilities flaw where the application utilizes unpatched libraries or sub-components, which could allow an attacker to identify and exploit publicly known security vulnerabilities to gain unauthorized access or compromise the application.
AnalysisAI
HCL DFXAnalytics contains unpatched third-party libraries with known vulnerabilities that could allow remote attackers with high effort to gain limited unauthorized access. The application fails to update or isolate vulnerable dependencies, potentially enabling exploitation of publicly disclosed security flaws in embedded components to bypass authentication or extract sensitive information.
Technical ContextAI
The vulnerability stems from CWE-1395 (Using Components with Known Vulnerabilities), a supply-chain and dependency management weakness. DFXAnalytics integrates third-party libraries or sub-components that contain published security flaws but remain unpatched within the application. The specific vulnerable libraries and their CVEs are not disclosed in available sources, but this pattern typically involves outdated versions of common Java, JavaScript, or system libraries used in analytics and monitoring platforms. The root cause is insufficient dependency scanning and patch management during the development and maintenance lifecycle.
RemediationAI
Contact HCL Software support immediately to obtain a patched version of DFXAnalytics that addresses all embedded vulnerable dependencies. Apply the recommended update once released via the support portal (https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0130569). Pending patch availability, implement network-level access controls to restrict DFXAnalytics to authorized internal users only, isolate the application on a segmented network with minimal outbound connectivity to limit exploitation of any leveraged vulnerability, and enable detailed logging and monitoring of authentication and data access events to detect potential abuse. If the specific vulnerable libraries are disclosed by HCL, conduct a manual inventory using tools like SBOM or dependency checkers (e.g., npm audit, Maven dependency check) to confirm local exposure. Note that workarounds cannot fully mitigate supply-chain vulnerabilities; patching is the primary remediation.
A Boolean-based SQL injection vulnerability exists in HCL Unica that allows remote attackers to manipulate backend datab
Command injection in HCL BigFix RunBookAI 11.2 allows authenticated remote attackers to execute arbitrary operating syst
HCL BigFix Service Management (SX) is affected by a Broken Access Control vulnerability leading to privilege escalation.
SQL injection in HCL Aftermarket DPC version 1.0.0 enables unauthenticated remote attackers to extract sensitive databas
Content Security Policy weakness in HCL Hive Telco Observability's Keycloak authentication component allows remote attac
Missing functional level access control in HCL Aftermarket DPC version 1.0.0 enables privilege escalation attacks that c
Hardcoded credentials in HCL Aftermarket DPC version 1.0.0 enable authenticated low-privilege attackers with user intera
HCL Aftermarket DPC version 1.0.0 is vulnerable to unauthenticated file discovery that allows remote attackers to read s
HCL Aftermarket DPC versions up to 1.0.0 are vulnerable to session fixation attacks that enable attackers to hijack user
HCL AION contains inadequate auditing and logging mechanisms that fail to properly track certain user actions, reducing
HCL Aftermarket DPC versions prior to and including 1.0.0 suffer from an unrestricted file upload vulnerability (CWE-434
HCL AION contains a container base image authentication vulnerability where container images are not properly verified b
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today