HCL AION CVE-2025-62305

Exploitation requires all of the following conditions: (1) attacker presence on the same adjacent network segment or directly connected network as the AION system-not remote Internet access, (2) valid low-privilege user credentials for AION (authenticated user, not unauthenticated), (3) user interaction with the application to trigger the vulnerable operation, and (4) specific AION operation or workflow that initiates out-of-band interactions (not all AION features). Exploitation is not possible against isolated or air-gapped AION deployments without network path to external systems, nor against AION instances accessible only via VPN with strict egress controls. Default AION configurations may or may not enable the vulnerable behavior; refer to vendor advisory for specific conditions.

CVSS score of 5.1 (medium) reflects modest real-world risk despite multiple restricting factors. Attack vector is limited to adjacent networks (AV:A), not remote Internet access, significantly reducing exposure surface. Low privilege authentication (PR:L) and required user interaction (UI:R) further constrain the threat model-an attacker cannot exploit passively or from unauthenticated network positions. Confidentiality, integrity, and availability impacts are all rated 'Low' (L), indicating partial rather than complete compromise of sensitive data or system function. EPSS score, KEV status, and POC availability are not provided in the input data, so exploitation prevalence cannot be assessed. The risk is primarily applicable to insider threats, compromised accounts on trusted networks, or adversaries with network adjacency to AION deployments. Organizations with AION in isolated or air-gapped networks face lower risk than those with Internet-facing or cloud-hosted instances.

An attacker with a low-privileged account on the AION platform (e.g., a contractor account or compromised user credential) logs in and performs a specific operation-such as initiating a workflow, exporting data, or configuring an integration. This triggers an unintended out-of-band request from AION to an external system controlled by the attacker, leaking sensitive metadata, session tokens, or data payload. If the user is interacting with the AION interface at the moment, or if the operation is designed to respond to user-initiated actions, the attacker can correlate timing or content to confirm data exfiltration.