HCL AION CVE-2025-62315

Exploitation requires the attacker to be positioned on an adjacent network segment (same LAN, VLAN, or subnet - not routable over the open internet). The attacker must possess a valid low-privileged authenticated account within HCL AION. A victim user must actively interact with or render the content containing the crafted input (UI:R). The specific input fields affected are not named in available public data - the HCL advisory (KB0133084) should be consulted for exact field or feature identification. Exploitation is limited by: adjacency-only network access (rules out internet-facing exploitation), requirement for prior authentication at low privilege, mandatory victim interaction, and a confidentiality-only impact with no integrity or availability consequence.

The overall risk is low. The CVSS 3.1 base score of 3.4 reflects a narrow exploitation envelope: AV:A constrains the attacker to the same network segment or VLAN as the target, AC:L indicates no special race condition or configuration complexity is required, PR:L means the attacker must already hold a valid low-privileged account, UI:R means a victim must take an action (e.g., view crafted content), and the sole impact is C:L with no integrity or availability consequence. The scope change (S:C) elevates severity slightly by indicating the confidentiality leakage reaches beyond the immediately vulnerable component. No EPSS data was provided, and the vulnerability is absent from CISA KEV, indicating no confirmed active exploitation. The combination of adjacent-only vector, required authentication, and mandatory user interaction makes opportunistic mass exploitation implausible. This is a real but low-priority finding most relevant to insider-threat or post-compromise scenarios within the same network segment.

An authenticated attacker with a low-privileged account on the same network segment as HCL AION v2.1.0 crafts a malicious payload in one of the unvalidated input fields. When a victim user views or interacts with the affected output - for example, a rendered page or report containing the injected data - the payload executes in their session context, leaking limited confidential information such as session tokens or displayed data to the attacker. No public proof-of-concept code has been identified at time of analysis.