Hcl EUVD-2025-209061

The CVSS v3.1 score of 4.2 (Medium) with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L reflects moderate real-world risk. The attack vector is network-based and requires no authentication (PR:N), but attack complexity is high (AC:H) and user interaction is required (UI:R), which significantly reduces exploit probability. The CISA SSVC decision framework confirms no public exploitation (Exploitation: none) and indicates the attack is not automatable (Automatable: no), with only partial technical impact. The absence of active KEV status and confirmed public exploit code further reduces immediate threat severity. However, weak password policies remain a persistent baseline risk in environments with high user volumes or valuable target accounts, making this a lower-priority but non-negligible vulnerability suited for standard patching cycles rather than emergency response.

An unauthenticated attacker discovers the HCL Aftermarket DPC login interface and launches a brute-force attack against known or enumerated usernames. Due to weak password policy enforcement, many users have set simple passwords such as 'Password123' or 'Company2025'. The attacker performs offline dictionary attacks using common password lists combined with organization-specific terms, or conducts low-rate online brute-force attempts to avoid rapid account lockout. After compromising valid credentials, the attacker gains unauthorized access to the user account, exposing confidential information and potentially disrupting system availability. No publicly available exploit code has been identified; exploitation relies on standard brute-force tooling and social engineering reconnaissance rather than sophisticated technical exploits.