EUVD-2025-209852
GHSA-j49v-863r-6fh8
CVSS VectorNVD
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Lifecycle Timeline
2DescriptionNVD
HCL AION is affected by a vulnerability where adequate protections against brute-force attempts are not enforced. This may allow repeated authentication attempts, potentially leading to unauthorized access or account compromise under certain conditions.
AnalysisAI
HCL AION lacks adequate brute-force protections on authentication mechanisms, allowing repeated login attempts that could lead to account compromise or unauthorized access. The vulnerability requires adjacent network access and affects all versions of the product. No public exploit code has been identified, but the weak authentication controls represent a significant credential-stuffing and password-guessing risk in multi-tenant or shared-network environments.
Technical ContextAI
HCL AION's authentication system fails to implement standard brute-force mitigation controls such as account lockouts, exponential backoff, CAPTCHA challenges, or rate limiting on login endpoints. This is rooted in CWE-307 (Improper Restriction of Excessive Authentication Attempts), a foundational authentication weakness. The adjacent network vector (AV:A) suggests the vulnerability may be exploited from the local network segment or via systems with network proximity, rather than from the open internet. The lack of privilege requirements (PR:N) means any unauthenticated attacker with network access can attempt unlimited login cycles.
RemediationAI
Contact HCL support via the referenced knowledge base article (KB0130636) to obtain a patched version; no specific fix version is confirmed in available data. In the interim, implement network-level compensating controls: restrict login endpoint access to trusted IP ranges using firewall or Web Application Firewall (WAF) rules, enforce source IP whitelisting for administrative authentication, deploy a reverse proxy with built-in rate limiting (e.g., fail2ban, ModSecurity, AWS WAF) to trigger temporary blocks after 5 failed attempts per minute, and configure account lockouts at the application level if supported (note: this may degrade user experience if legitimate users mistype credentials). For organizations with directory integration (LDAP, Active Directory), ensure the AION authentication chain delegates lockout enforcement to the directory service rather than local validation. Monitor authentication logs for repeated failed attempts targeting service accounts or high-privilege users; configure alerting at thresholds below brute-force timescales (e.g., 10 failures in 5 minutes). These controls address the root cause until a vendor patch is deployed.
Share
External POC / Exploit Code
Leaving vuln.today