HCL AION CVE-2025-62313

Adjacent network access (AV:A) is required - the attacker must be on the same network segment or have routable connectivity to AION's authentication endpoint. This rules out remote exploitation from the public internet unless the authentication service is directly exposed (verify network topology). No authentication is required to initiate login attempts (PR:N), meaning any network-adjacent user or compromised client can execute the attack. No user interaction is needed (UI:N). The vulnerability manifests in all default AION installations that do not implement external brute-force protections; however, organizations that have deployed WAF/proxy-layer rate limiting or directory service account lockouts may partially mitigate risk. The primary limiting factor is network isolation: air-gapped or restricted-access deployments face negligible risk.

The CVSS 5.4 score reflects moderate impact with limited attack scope, driven by the adjacent network requirement (AV:A) which significantly constrains real-world exploitability compared to network-wide attacks. However, EPSS data and KEV status are not provided, preventing confirmation of active exploitation likelihood. The integrity and availability impact (I:L/A:L) is low, suggesting the primary risk is account compromise rather than system-wide takeover. In corporate networks with strong perimeter controls and centralized authentication, the adjacent-network requirement substantially reduces risk. Conversely, in cloud deployments, remote offices with VPN access, or environments where attackers have already gained network foothold, the lack of brute-force protections becomes a critical secondary attack vector for lateral privilege escalation. The absence of patch data and the vague advisory URL suggest HCL may not have released a fix; verify with vendor whether this is a design-phase mitigation or a pending patch.

An attacker with access to the corporate network (via compromised endpoint, guest WiFi, or VPN) performs credential-stuffing attacks against HCL AION using a leaked password list from external breaches. The attacker scripts repeated login attempts over several hours without triggering account lockouts or rate-limit blocks. Once valid credentials are discovered, the attacker gains unauthorized access to AION and pivots to downstream systems or extracts sensitive configuration data.