Hcl EUVD-2025-208721

The CVSS 3.1 score of 5.6 reflects Medium severity with attack vector Local, high complexity, and high privilege requirements, limiting real-world exploitability. The CVSS vector (AV:L/AC:H/PR:H/UI:R) indicates an attacker must have local system access, administrative privileges, and requires user interaction, significantly constraining the threat landscape. While the impact is High for both Integrity and Availability, the restrictive prerequisites (local access, high privileges, user interaction) reduce the realistic threat profile compared to network-accessible vulnerabilities. Without confirmed EPSS data, KEV listing, or POC availability from the intelligence provided, this appears to be a moderate priority vulnerability requiring remediation but not presenting immediate widespread risk. Organizations should prioritize patching but can apply operational compensating controls in the interim.

An attacker with local system access and administrative privileges could manipulate the container deployment process, injecting a malicious base image that AION fails to authenticate due to disabled or misconfigured verification controls. Upon deployment, the malicious container would execute with AION's trust, potentially compromising data integrity or causing service disruption. The attack requires high privilege access and user interaction (such as manual deployment approval), limiting opportunistic exploitation but remaining viable in insider threat or post-compromise scenarios.