Hcl EUVD-2025-209069

CVSS 4.3 (Medium) reflects a network-accessible, low-complexity attack requiring user interaction with limited integrity impact and no confidentiality or availability impact. However, the SSVC framework provides a more nuanced picture: exploitation status is currently 'none' (no active exploitation detected), the attack is 'not automatable' (requires user click/visit), and technical impact is 'partial' (session hijacking is possible but not guaranteed). The gap between CVSS and SSVC signals suggests this is a real but constrained threat-attackers would need to either control a network path (man-in-the-middle) or convince users to visit a page they control. EPSS data is not provided, but the combination of unauthenticated network access (AV:N), lack of public POC, and absence of KEV status indicates moderate real-world priority. Organizations with strong network segmentation and content security policies are at lower risk.

An attacker crafts a phishing email containing a link to the vulnerable HCL Aftermarket DPC application with a malicious query parameter or POST body that causes the application to include a script from an attacker-controlled domain. When a user clicks the link and visits the application, the injected script executes, stealing the user's session cookie and transmitting it to the attacker, who can then impersonate the user. No public exploit code has been identified, and successful exploitation depends on user interaction and application-side validation weaknesses.