Hcl EUVD-2025-209079

The vulnerability presents a moderate real-world risk profile despite the high CVSS base score of 8.1. CVSS metrics indicate network-based exploitation with low attack complexity and no privileges required, yielding high confidentiality impact and high availability impact but no integrity impact. However, user interaction is required (UI:R), reducing immediate exploitability. CISA SSVC framework assessment indicates no current exploitation activity, non-automatable attack chains, and partial technical impact, suggesting lower prioritization compared to weaponized vulnerabilities. The absence of public exploit code and KEV listing further reduces urgency. EPSS probability data was not provided but the combination of required user interaction and lack of observed exploitation suggests this is not a widespread immediate threat, though organizations running Aftermarket DPC 1.0.0 should prioritize remediation due to the unauthenticated attack surface and data manipulation potential.

An unauthenticated remote attacker crafts a malicious link or phishing email containing a direct URL to privileged administrative functions within HCL Aftermarket DPC 1.0.0. When a legitimate user clicks the link (satisfying the UI:R requirement), the application processes the request without validating functional authorization, allowing the attacker to execute privileged operations such as accessing sensitive aftermarket data, modifying inventory records, or disrupting application availability. The low attack complexity (AC:L) indicates readily available exploitation techniques once user interaction is achieved, requiring no specialized tools or environmental conditions.