EUVD-2025-208721
CVSS Vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:H
Lifecycle Timeline
3Description
HCL AION is affected by a vulnerability where container base images are not properly authenticated. This may expose the system to potential security risks such as usage of untrusted container images, which could lead to unintended behaviour or security impact.
Analysis
HCL AION contains a container base image authentication vulnerability where container images are not properly verified before deployment, potentially allowing attackers to execute untrusted or malicious container images within the AION environment. This affects AION 2.0 and could enable attackers with local access and high privileges to compromise system integrity and availability. No public evidence of active exploitation or POC availability has been identified in the provided intelligence sources.
Technical Context
The vulnerability (CWE unspecified but related to authentication/verification mechanisms) exists in HCL AION's container orchestration layer where base container images lack proper cryptographic verification or signature validation before execution. Container platforms typically rely on image digests, digital signatures, or registry authentication to ensure image integrity and source authenticity. AION's implementation appears to bypass or improperly implement these controls, as identified via CPE cpe:2.3:a:hcl:aion:*:*:*:*:*:*:*:*, allowing deployment of unsigned, tampered, or malicious base images. This is fundamentally an authentication and integrity control failure in the container image supply chain within the AION platform.
Affected Products
HCL AION 2.0 is affected by this vulnerability as confirmed via ENISA EUVD ID EUVD-2025-208721 and CPE designation cpe:2.3:a:hcl:aion:*:*:*:*:*:*:*:*. The vendor advisory is available at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129410. Specific patch availability and remediation guidance should be obtained directly from the HCL support portal referenced above.
Remediation
Obtain and apply the security patch from HCL AION as documented in the vendor advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129410. Until patches are deployed, implement compensating controls by enforcing container image signature verification at the registry level, restricting container image pulls to approved and internally scanned registries only, implementing strict role-based access controls to limit container deployment to authorized personnel, and conducting security scanning of all base images before deployment. Enable audit logging for all container image operations to detect unauthorized image usage attempts.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today