EUVD-2026-44917
GHSA-3252-v85m-5fq8
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Replay attack demands MitM positioning (AC:H) but the attacker requires no privileges on the target application (PR:N); replayed session yields limited read/write access in another user's context (C:L, I:L, S:C).
Primary rating from Vendor (HCL).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
HCL DFXAnalytics is affected by a Login Replay Attack vulnerability. The application allows a remote attacker to intercept, delay, or fraudulently retransmit valid authentication data to achieve unauthorized access. To mitigate this risk, the application must implement a mechanism to include timestamps with every message, ensuring that messages exceeding a specific age threshold are automatically rejected by the recipient system.
AnalysisAI
Login replay vulnerability in HCL DFXAnalytics enables a remote attacker in a man-in-the-middle network position to capture and retransmit valid authentication messages, gaining unauthorized access as a legitimate user. The application lacks message-freshness enforcement - no timestamps or nonce mechanisms are applied to bound the validity window of authentication data, a design gap classified under CWE-294. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; the combination of high attack complexity and mandatory user interaction substantially limits realistic exploitation scope.
Technical ContextAI
HCL DFXAnalytics (cpe:2.3:a:hcl_software:dfxanalytics:*:*:*:*:*:*:*:*) is an enterprise data analytics platform from HCL Software. The root cause is CWE-294 (Authentication Bypass by Capture-Replay), a class of flaw where authentication messages carry no time-bound validity anchor - no server-generated nonce, no timestamp checked against an acceptable skew window, and no one-time token consumed on use. When a legitimate user authenticates, the application emits credential material that remains valid indefinitely at the protocol or session layer. An adversary who intercepts that exchange - through ARP spoofing, a compromised network device, or any other man-in-the-middle technique - can retransmit the captured data later and the server will accept it as a fresh, valid authentication. The vendor's own advisory at KB0131787 explicitly identifies the absence of timestamp-based message expiry as the architectural root cause and recommends its implementation as the primary fix.
RemediationAI
Apply the update or configuration guidance detailed in HCL's advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131787; no specific patched version number has been confirmed from the available data, so customers should consult the advisory directly. The vendor's stated remediation path is implementing server-side timestamp validation on all authentication messages, configured to automatically reject any message whose embedded timestamp exceeds a defined age threshold - organizations should confirm this control is active post-update. Where immediate patching is not feasible, the following compensating controls reduce exposure in descending effectiveness: enforce TLS with mutual certificate validation on all DFXAnalytics network paths to raise the technical bar for interception (note that TLS prevents passive sniffing but does not fully block replay if the application layer remains stateless about message freshness); restrict DFXAnalytics to trusted network segments via firewall rules or VLAN isolation to reduce the attacker's opportunity for MitM positioning; reduce session token lifetimes to the minimum operationally acceptable value to narrow the replay window; and enable network-level anomaly detection to flag repeated authentication events from the same captured token or unusual source addresses.
More in Dfxanalytics
View allDenial of service in HCL DFXAnalytics version 3.0 and below allows remote unauthenticated attackers to crash or hang the
Cleartext-adjacent data exposure in HCL DFXAnalytics (version 3.0 and below) stems from continued support for the deprec
Account takeover in HCL DFXAnalytics version 3.0 and below allows a remote attacker to intercept and alter server HTTP r
Cross-Site Request Forgery exposure in HCL DFXAnalytics arises because session cookies generated during authentication a
HCL DFXAnalytics exposes internal file system paths and directory structure through unhandled error messages, system log
HCL DFXAnalytics fails to enforce strict Content-Security-Policy (CSP) directives for object-src and base-uri, enabling
Session cookie exposure in HCL DFXAnalytics (version 3.0 and below) occurs because authentication-generated cookies are
Internal IP address disclosure in HCL DFXAnalytics (version 3.0 and below) exposes internal network topology data embedd
HCL DFXAnalytics contains unpatched third-party libraries with known vulnerabilities that could allow remote attackers w
HCL DFXAnalytics transmits sensitive data over the network without encryption, allowing network-positioned attackers to
Insecure file permissions on the HCL DFMPro (for CATIA), DFXAnalytics, and DFXServer installer executables allow any loc
Missing HSTS header in HCL DFXAnalytics exposes authenticated sessions to protocol downgrade and man-in-the-middle attac
Same weakness CWE-294 – Authentication Bypass by Capture-replay
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today