Hcl EUVD-2025-209085

The CVSS 3.1 score of 5.5 reflects a moderate severity with network attack vector (AV:N), low attack complexity (AC:L), low privilege requirement (PR:L-authenticated access required), requiring user interaction (UI:R), and scope unchanged (S:U), resulting in partial confidentiality, integrity, and availability impact (C:L/I:L/A:L). Per the SSVC decision framework, exploitation is classified as 'none' (no confirmed active exploitation), the attack is not automatable (requires prior authentication and user action interaction), and technical impact is 'partial'. The CISA KEV status is not listed, indicating no confirmed active exploitation in the wild. While the underlying flaw is genuine and would allow account takeover if exploited, the real-world risk is constrained by the requirement for prior authenticated session access and the non-trivial nature of obtaining that access in the first place. This is a legitimate but not critical-priority vulnerability-patch when convenient within normal maintenance cycles rather than emergency response protocols.

An attacker obtains a valid authenticated session token for a user (e.g., through credential harvesting, social engineering, or network interception). The user, unaware of the compromise, changes their password hoping to secure their account. The attacker continues using the original session token to access the account and perform actions such as viewing sensitive data (confidentiality impact), modifying account settings or data (integrity impact), or disrupting service (availability impact). The attacker requires low privileges (an existing authenticated session) and user interaction (the password change action must occur) but faces low technical complexity, making exploitation straightforward once initial session access is obtained.