HCL DevOps Deploy CVE-2025-62330

Exploitation requires that the HCL DevOps Deploy HTTP listener remains enabled and reachable and that it does not redirect to HTTPS (the default/as-shipped behavior described), AND that a victim actually sends credentials or session data over that cleartext HTTP channel. The attacker must additionally hold an on-path or same-segment network position enabling passive packet capture or active man-in-the-middle interception - this network-position requirement (reflected as AC:H) is the primary limiting factor and means the flaw is not exploitable by an arbitrary remote attacker with no path access. Risk is substantially higher for deployments exposed to untrusted or shared networks and effectively mitigated where only HTTPS is reachable or TLS is terminated upstream.

This is a genuine-but-moderate issue, not a drop-everything priority. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N, C:H/I:N/A:N, score 5.9) shows a network-reachable, unauthenticated weakness whose only rated impact is confidentiality - but AC:H is the critical signal: successful attack requires the adversary to already occupy a privileged position on the network path (man-in-the-middle or passive traffic capture), which is the realistic throttle on exploitation. EPSS reinforces low urgency at 0.15% (4th percentile), and there is no CISA KEV listing and no public exploit identified at time of analysis, so there is no evidence of active exploitation or weaponization. No SSVC decision data was provided in the input. The signals are mutually consistent rather than conflicting: a high-confidentiality TLS/cleartext flaw that is technically network-exploitable but practically gated by the need for adjacent network access and plaintext HTTP usage, hence the sub-6.0 score and very low EPSS. One note of caution: the CVSS vector sets I:N, yet the vendor description explicitly says an attacker could 'modify' credentials and session data via MITM - that implies an integrity impact the published vector does not credit, so the official I:N likely understates the flaw (see assessed vector below). Treat this as a standard-priority TLS hardening/configuration fix, prioritized higher for internet-exposed or untrusted-network deployments.

An attacker on a shared or compromised network segment between users and an HCL DevOps Deploy server passively captures traffic sent to the still-open HTTP port, or actively intercepts it as a man-in-the-middle. Because the server fails to redirect HTTP to HTTPS, a user's login credentials and session tokens traverse the wire in cleartext and are harvested, after which the attacker replays the session or modifies in-flight data. No public exploit is required - standard network sniffing or interception tooling suffices once network position is obtained.