EUVD-2025-210480
GHSA-xrg7-hrrm-57fm
Severity by source
AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
Successful exploitation yields arbitrary code execution as a privileged user (S:C, C:H/I:H/A:H); AC:H and UI:R reflect timing dependency on admin running installer.
Primary rating from Vendor (HCL).
CVSS VectorVendor: HCL
Lifecycle Timeline
1DescriptionCVE.org
The HCL DFMPro, DFXAnalytics and DFXServer installers are affected by ‘Insecure file permissions Leading to Privilege Escalation’ vulnerability, which enables any logged-in non-administrative user to overwrite or replace the executable file with a malicious binary.
AnalysisAI
Insecure file permissions on the HCL DFMPro (for CATIA), DFXAnalytics, and DFXServer installer executables allow any locally authenticated non-administrative user to overwrite or replace those binaries with malicious code. When a privileged user subsequently runs the tampered installer - during installation, upgrade, or reinstallation - the attacker's binary executes in the elevated context, completing a local privilege escalation. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; however, the vendor-reported CVSS 3.3 score materially understates the potential impact of a successful exploitation scenario.
Technical ContextAI
CWE-732 (Incorrect Permission Assignment for Critical Resource) describes the root cause: the affected HCL installer binaries are stored with file-system ACLs that grant write or modify rights to non-administrative local users. On Windows - the typical deployment platform for CATIA-integrated tooling - this manifests as NTFS permissions allowing any authenticated user (Users group) to overwrite executables that should be restricted to administrators. The affected products are HCL DFMPro for CATIA (cpe:2.3:a:hclsoftware:dfmpro_for_catia), HCL DFXAnalytics (cpe:2.3:a:hclsoftware:dfxanalytics), and HCL DFXServer (cpe:2.3:a:hclsoftware:dfxserver). This is a classical binary planting or installer hijacking pattern, exploitable without any vulnerability in the application's runtime logic.
RemediationAI
Consult the HCL advisory KB0132365 at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132365 to obtain patched installer versions; an exact fix version is not independently confirmed from the available reference data, so direct review of that article is required. As an immediate compensating control, restrict NTFS permissions on the directories containing these installer executables so that only the local Administrators group and SYSTEM account hold write or modify rights - removing any permissions granted to the Users or Authenticated Users groups. Installer binaries should be removed from end-user-accessible locations immediately after deployment and stored in protected administrative shares. Deploy a file integrity monitoring (FIM) solution against installer directories to detect unauthorized binary replacement. These controls are effective but add operational overhead to the software update workflow, requiring administrators to stage installers from protected locations at update time.
More in Dfxanalytics
View allDenial of service in HCL DFXAnalytics version 3.0 and below allows remote unauthenticated attackers to crash or hang the
Cleartext-adjacent data exposure in HCL DFXAnalytics (version 3.0 and below) stems from continued support for the deprec
Account takeover in HCL DFXAnalytics version 3.0 and below allows a remote attacker to intercept and alter server HTTP r
Cross-Site Request Forgery exposure in HCL DFXAnalytics arises because session cookies generated during authentication a
HCL DFXAnalytics exposes internal file system paths and directory structure through unhandled error messages, system log
Login replay vulnerability in HCL DFXAnalytics enables a remote attacker in a man-in-the-middle network position to capt
HCL DFXAnalytics fails to enforce strict Content-Security-Policy (CSP) directives for object-src and base-uri, enabling
Session cookie exposure in HCL DFXAnalytics (version 3.0 and below) occurs because authentication-generated cookies are
Internal IP address disclosure in HCL DFXAnalytics (version 3.0 and below) exposes internal network topology data embedd
HCL DFXAnalytics contains unpatched third-party libraries with known vulnerabilities that could allow remote attackers w
HCL DFXAnalytics transmits sensitive data over the network without encryption, allowing network-positioned attackers to
Missing HSTS header in HCL DFXAnalytics exposes authenticated sessions to protocol downgrade and man-in-the-middle attac
Same technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today