EUVD-2025-208721Severity by source
AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
HCL AION is affected by a vulnerability where container base images are not properly authenticated. This may expose the system to potential security risks such as usage of untrusted container images, which could lead to unintended behaviour or security impact.
AnalysisAI
HCL AION contains a container base image authentication vulnerability where container images are not properly verified before deployment, potentially allowing attackers to execute untrusted or malicious container images within the AION environment. This affects AION 2.0 and could enable attackers with local access and high privileges to compromise system integrity and availability. No public evidence of active exploitation or POC availability has been identified in the provided intelligence sources.
Technical ContextAI
The vulnerability (CWE unspecified but related to authentication/verification mechanisms) exists in HCL AION's container orchestration layer where base container images lack proper cryptographic verification or signature validation before execution. Container platforms typically rely on image digests, digital signatures, or registry authentication to ensure image integrity and source authenticity. AION's implementation appears to bypass or improperly implement these controls, as identified via CPE cpe:2.3:a:hcl:aion:*:*:*:*:*:*:*:*, allowing deployment of unsigned, tampered, or malicious base images. This is fundamentally an authentication and integrity control failure in the container image supply chain within the AION platform.
RemediationAI
Obtain and apply the security patch from HCL AION as documented in the vendor advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129410. Until patches are deployed, implement compensating controls by enforcing container image signature verification at the registry level, restricting container image pulls to approved and internally scanned registries only, implementing strict role-based access controls to limit container deployment to authorized personnel, and conducting security scanning of all base images before deployment. Enable audit logging for all container image operations to detect unauthorized image usage attempts.
Content security policy bypass in HCL AION v2.0 enables inline script injection, allowing remote attackers to modify web
Session hijacking vulnerability in HCL AION 2.0 due to missing 'Secure' flag on SSL session cookies allows unauthenticat
HCL AION contains inadequate auditing and logging mechanisms that fail to properly track certain user actions, reducing
Insufficient anti-automation controls on certain HCL AION v2.1.0 endpoints allow scripted or automated requests to bypas
Aion versions up to 2.0 is affected by incorrect permission assignment for critical resource (CVSS 5.5).
Script allowlist bypass in HCL AION 2.0 allows unauthorized script execution through a misconfigured Content-Security-Po
HCL AION lacks adequate brute-force protections on authentication mechanisms, allowing repeated login attempts that coul
HCL AION fails to enforce encryption for certain data transmissions or operations, potentially exposing sensitive inform
HCL AION allows exposure of sensitive information through out-of-band interactions triggered by certain operations, affe
HCL AION exposes sensitive backend infrastructure details through an information disclosure vulnerability affecting auth
A security vulnerability in HCL AION (CVSS 4.7). Remediation should follow standard vulnerability management procedures.
Aion versions up to 2.0 contains a vulnerability that allows attackers to cookies to be sent in cross-site requests, pot
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today