HCL DFXAnalytics CVE-2026-35145

Exploitation requires the attacker to achieve a network-on-path position between the victim's browser and the HCL DFXAnalytics server - for example via ARP spoofing, rogue Wi-Fi access point, or BGP hijacking - which is the source of the AC:H rating. The victim user must initiate an HTTP (non-HTTPS) connection, which occurs when no prior HSTS entry exists in the browser (i.e., first visit or cleared browser data). The CVSS PR:L metric indicates the vendor considers some level of authenticated context necessary, possibly reflecting that the application is deployed in environments where attacker network access implies some level of internal access. Exploitation is limited by: the requirement for active network positioning (not a passive remote attack), the need for a victim to make an HTTP request rather than directly accessing HTTPS, and the absence of default HTTP listener exposure in hardened deployments where HTTPS is enforced at the network or load-balancer tier.

The CVSS 3.1 base score of 3.1 (Low) reflects the realistic difficulty of exploitation: AV:N confirms the attack surface is network-facing, but AC:H (high attack complexity) acknowledges that a network-adjacent or on-path position is required to conduct the downgrade, and PR:L indicates the vendor considers an authenticated context necessary. EPSS data is not provided, but given the low CVSS, niche product footprint, and absence of KEV listing or public exploit code, exploitation probability is expected to be very low. The integrity impact (I:L) and no confidentiality impact (C:N) in the vendor-supplied vector are somewhat inconsistent with the MitM scenario described - cleartext interception would realistically expose session tokens or application data (C:L), not just allow modification. This discrepancy should be verified with the vendor advisory. No SSVC decision framework data is provided, but the combination of no known exploitation, high attack complexity, and low-prevalence product suggests this is a low-priority finding absent specific threat intelligence targeting HCL DFXAnalytics deployments.

An attacker with a network-adjacent position - such as on a shared corporate Wi-Fi segment or via ARP cache poisoning - intercepts a victim user's initial HTTP request to HCL DFXAnalytics before the browser can enforce HTTPS. The attacker uses an SSL-stripping tool to maintain a TLS connection upstream to the server while serving cleartext HTTP downstream to the victim, transparently proxying and reading or modifying application traffic including session cookies or submitted data. No public exploit code has been identified, but SSL-stripping tooling (e.g., bettercap, mitmproxy) is widely available and the technique is well understood.