Hcl EUVD-2025-209053

While the CVSS score of 6.5 indicates medium severity, the real-world risk profile is constrained by several mitigating factors. The CISA SSVC decision framework rates exploitation as none (not currently exploited), automatable as no (requires user interaction), and technical impact as partial (confidentiality only), collectively suggesting this is not an immediate priority for mass exploitation. The requirement for UI interaction (UI:R) and lack of reported public exploit code further reduce immediate exploitation probability. However, the high confidentiality impact (C:H) and unauthenticated network attack vector (AV:N, PR:N) mean that targeted adversaries could leverage this vulnerability to exfiltrate configuration files, credentials, or application source code to support more sophisticated follow-on attacks. Organizations running Aftermarket DPC should prioritize patching, but this does not constitute an emergency response scenario.

An attacker crafts a malicious link or hosts a phishing page that, when visited by an employee, triggers an automatic HTTP request to the Aftermarket DPC file discovery endpoint. The attacker uses the unauthenticated, low-complexity network interface to enumerate and retrieve sensitive configuration files, database connection strings, or API keys stored on the system. These credentials are then used to compromise downstream systems or facilitate a supply-chain attack against the organization's customers.