EUVD-2025-209663
GHSA-37m6-8rw8-wh8f
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionCVE.org
HCL DFXAnalytics is affected by an Insufficient Transport Layer Protection vulnerability where data is transmitted over the network without encryption, which could allow an attacker to compromise the confidentiality, integrity, and authentication of sensitive information.
AnalysisAI
HCL DFXAnalytics transmits sensitive data over the network without encryption, allowing network-positioned attackers to intercept and read confidential information. The vulnerability requires high attack complexity (likely man-in-the-middle positioning) but affects all versions of the product when unencrypted channels are in use. No active exploitation has been reported, and the low CVSS score (3.7) reflects limited confidentiality impact with no integrity or availability compromise.
Technical ContextAI
This is a transport layer protection weakness (CWE-319) in HCL DFXAnalytics where the application fails to enforce encrypted communication channels for network-transmitted data. Rather than a cryptographic algorithm flaw, the root cause is architectural-the application either defaults to unencrypted protocols (such as HTTP, telnet, or unencrypted database connections) or fails to mandate TLS/SSL for sensitive data flows. The high attack complexity in the CVSS vector suggests exploitation requires network positioning (e.g., ARP spoofing, BGP hijacking, or compromised network infrastructure) rather than simple passive sniffing, indicating some network segmentation or partial encryption may exist but is incomplete or bypassable.
RemediationAI
Enable encryption for all network communications in HCL DFXAnalytics by enforcing TLS 1.2 or higher for all data transport channels, including client-server connections and backend database communications. Configure the application to reject unencrypted connections and validate certificate chains. Apply any security patches from HCL that address transport layer protection-check HCL support article KB0130569 for available fixes and configuration guidance. As a compensating control, restrict network access to DFXAnalytics instances using firewall rules and network segmentation, permitting connections only from authorized administrative clients and backend systems; this reduces attack surface but does not eliminate the vulnerability if an attacker gains network access. Additionally, implement network-level encryption via VPN or IPsec for all DFXAnalytics traffic if application-level TLS cannot be immediately deployed, though this creates operational complexity and should be treated as a temporary measure pending full TLS enforcement.
A Boolean-based SQL injection vulnerability exists in HCL Unica that allows remote attackers to manipulate backend datab
Command injection in HCL BigFix RunBookAI 11.2 allows authenticated remote attackers to execute arbitrary operating syst
HCL BigFix Service Management (SX) is affected by a Broken Access Control vulnerability leading to privilege escalation.
SQL injection in HCL Aftermarket DPC version 1.0.0 enables unauthenticated remote attackers to extract sensitive databas
Content Security Policy weakness in HCL Hive Telco Observability's Keycloak authentication component allows remote attac
Missing functional level access control in HCL Aftermarket DPC version 1.0.0 enables privilege escalation attacks that c
Hardcoded credentials in HCL Aftermarket DPC version 1.0.0 enable authenticated low-privilege attackers with user intera
HCL Aftermarket DPC version 1.0.0 is vulnerable to unauthenticated file discovery that allows remote attackers to read s
HCL Aftermarket DPC versions up to 1.0.0 are vulnerable to session fixation attacks that enable attackers to hijack user
HCL AION contains inadequate auditing and logging mechanisms that fail to properly track certain user actions, reducing
HCL Aftermarket DPC versions prior to and including 1.0.0 suffer from an unrestricted file upload vulnerability (CWE-434
HCL AION contains a container base image authentication vulnerability where container images are not properly verified b
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today