Hcl EUVD-2025-209081

The CVSS v3.1 score of 8.3 (High) reflects network accessibility (AV:N), low attack complexity (AC:L), no privileges required (PR:N), but requires user interaction (UI:R). Impact ratings show high confidentiality (C:H), low integrity (I:L), and high availability (A:H) impact with unchanged scope. SSVC framework assessment indicates no current exploitation, non-automatable attacks, and partial technical impact, which moderates immediate urgency. No EPSS score is provided in the intelligence, and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation. The combination of high CVSS but SSVC designation of no exploitation and non-automatable characteristics suggests this is a significant vulnerability requiring patching but not representing an immediate mass-exploitation threat. The UI:R requirement and lack of automation potential reduce weaponization risk compared to fully unauthenticated SQLi with no user interaction.

An unauthenticated remote attacker crafts malicious SQL payloads within HTTP requests to the HCL Aftermarket DPC web interface, exploiting improper input sanitization possibly combined with hard-coded database credentials. Through social engineering or by inducing a legitimate user to access a malicious link (satisfying the UI:R requirement), the attacker executes arbitrary SQL commands against the backend database. The attacker extracts sensitive parts inventory data, customer information, pricing details, and potentially modifies or deletes critical transaction records, causing business disruption.