EUVD-2026-44905
GHSA-g8m2-fxgf-6pqg
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
AC:H because successful interception requires a privileged MITM network position; I:N and A:N as passive channel interception does not directly affect integrity or availability.
Primary rating from Vendor (HCL).
CVSS VectorVendor: HCL
Lifecycle Timeline
1DescriptionCVE.org
HCL DFXServer is affected by an Unencrypted Communication vulnerability. The application permits users to establish connections over unencrypted channels via the HTTP protocol, which could allow a remote attacker to intercept network traffic and expose sensitive data transmitted between the user and the application.
AnalysisAI
HCL DFXServer permits client connections over plaintext HTTP, exposing all transmitted data to interception by any attacker with a man-in-the-middle position on the network path. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) confirms remote exploitation without authentication, contingent on a user initiating an HTTP session. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the risk is structurally inherent to any deployment where HTTP remains permitted alongside or instead of HTTPS.
Technical ContextAI
CWE-326 (Inadequate Encryption Strength) describes the root cause: the application does not enforce a minimum transport security standard and accepts connections over unencrypted HTTP. The affected product is HCL DFXServer by HCL Software (CPE: cpe:2.3:a:hclsoftware:dfxserver:*:*:*:*:*:*:*:*), which covers all known versions with no lower bound specified. DFXServer is a server-side application component in HCL's product line. Because the transport layer is unencrypted, any credentials, session tokens, or sensitive application data exchanged between a browser or client and the server traverse the network in plaintext, making them readable to any observer on the path - including compromised routers, rogue wireless access points, or adversaries executing ARP/DNS spoofing on the local segment.
RemediationAI
The primary remediation is to enforce TLS (HTTPS) for all client-to-server communication and disable or redirect plaintext HTTP connections at the application or reverse-proxy layer. Consult the HCL vendor advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131782 for vendor-specific guidance and any patched release information, as the fix version is not confirmed in the available intelligence. If a patched version is not yet available or applicable, immediate compensating controls include: terminating all inbound HTTP at a TLS-offloading reverse proxy (e.g., nginx or HAProxy configured to reject non-HTTPS) to enforce encryption without modifying the application - note this does not fix the underlying flaw but prevents plaintext exposure in transit; restricting DFXServer network exposure to isolated, trusted VLANs or VPN segments to reduce the attacker's ability to achieve a MITM position; and auditing firewall rules to confirm port 80 is not externally reachable. Each workaround requires operational testing to avoid breaking dependent integrations that may currently use HTTP.
Authentication bypass in HCL DFXServer allows remote unauthenticated attackers to reach specific API endpoints directly
Authentication bypass in HCL DFXServer lets an unauthenticated remote attacker intercept and tamper with the server's au
Unauthenticated API access in HCL DFXServer exposes application endpoints to any network-reachable user without identity
Insecure file permissions on the HCL DFMPro (for CATIA), DFXAnalytics, and DFXServer installer executables allow any loc
Same weakness CWE-326 – Inadequate Encryption Strength
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today