EUVD-2026-44922
GHSA-4h8f-jwxw-9996
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack needs an active on-path MITM plus a downgrade/padding-oracle technique against victim traffic, so AC:H and UI:R; confidentiality-only exposure gives C:H, I:N, A:N.
Primary rating from Vendor (HCL).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
HCL DFXAnalytics is affected by a Deprecated Protocol vulnerability due to the use of TLS 1.0 and TLS 1.1. These legacy protocols contain numerous cryptographic design flaws that expose data to interception and decryption. To remediate this risk, the application must disable all support for TLS 1.0 and TLS 1.1, and exclusively enable support for secure protocols, specifically TLS 1.2 and TLS 1.3.
AnalysisAI
Cleartext-adjacent data exposure in HCL DFXAnalytics (version 3.0 and below) stems from continued support for the deprecated TLS 1.0 and TLS 1.1 protocols, whose known cryptographic weaknesses let a suitably positioned attacker intercept and potentially decrypt session traffic. The flaw is an information-disclosure/confidentiality issue reported by HCL; there is no public exploit identified at time of analysis and EPSS is very low (0.14%, 3rd percentile). SSVC scores exploitation as none and automatable as no, indicating a real but low-urgency hardening issue rather than an actively targeted vulnerability.
Technical ContextAI
The vulnerability falls under CWE-327 (Use of a Broken or Risky Cryptographic Algorithm), applied here to the transport layer rather than an application cipher. DFXAnalytics negotiates TLS sessions and permits legacy TLS 1.0 (1999) and TLS 1.1 (2006), both formally deprecated by RFC 8996 and disabled by default in modern browsers and platforms since 2020. These versions rely on weak constructions - CBC-mode padding vulnerable to POODLE and BEAST, RC4 biases, MAC-then-encrypt, and support for downgraded/export cipher suites - that collectively undermine confidentiality guarantees. The affected component per CPE is cpe:2.3:a:hcl_software:dfxanalytics:*, covering all releases up to and including 3.0. Root cause is a configuration/policy weakness in the TLS stack rather than a memory-safety or injection defect: the server simply advertises and accepts protocol versions that no longer provide sound cryptographic protection.
RemediationAI
The vendor guidance (HCL KB0131787, https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131787) is to disable all support for TLS 1.0 and TLS 1.1 in the DFXAnalytics deployment and enable only TLS 1.2 and TLS 1.3; no discrete patched release version is stated in the available data, so this is a configuration-hardening remediation rather than a code patch (patch available per vendor advisory as configuration guidance). Operationally, restrict the server/TLS terminator's protocol list to TLS 1.2+ and prune weak cipher suites (RC4, CBC-mode legacy suites, export-grade); if DFXAnalytics sits behind a reverse proxy or load balancer, enforce the minimum protocol there as a fast compensating control. The main trade-off is compatibility: very old clients or integrations that only speak TLS 1.0/1.1 will lose connectivity, so inventory dependent clients before enforcing, and where a legacy client cannot be upgraded, isolate it to a segmented network path rather than re-enabling the deprecated protocol globally.
More in Dfxanalytics
View allDenial of service in HCL DFXAnalytics version 3.0 and below allows remote unauthenticated attackers to crash or hang the
Account takeover in HCL DFXAnalytics version 3.0 and below allows a remote attacker to intercept and alter server HTTP r
Cross-Site Request Forgery exposure in HCL DFXAnalytics arises because session cookies generated during authentication a
HCL DFXAnalytics exposes internal file system paths and directory structure through unhandled error messages, system log
Login replay vulnerability in HCL DFXAnalytics enables a remote attacker in a man-in-the-middle network position to capt
HCL DFXAnalytics fails to enforce strict Content-Security-Policy (CSP) directives for object-src and base-uri, enabling
Session cookie exposure in HCL DFXAnalytics (version 3.0 and below) occurs because authentication-generated cookies are
Internal IP address disclosure in HCL DFXAnalytics (version 3.0 and below) exposes internal network topology data embedd
HCL DFXAnalytics contains unpatched third-party libraries with known vulnerabilities that could allow remote attackers w
HCL DFXAnalytics transmits sensitive data over the network without encryption, allowing network-positioned attackers to
Insecure file permissions on the HCL DFMPro (for CATIA), DFXAnalytics, and DFXServer installer executables allow any loc
Missing HSTS header in HCL DFXAnalytics exposes authenticated sessions to protocol downgrade and man-in-the-middle attac
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today