HCL Hive EUVD-2025-210064

Exploitation requires a Keycloak-authenticated HCL Hive Telco Observability user to interact with attacker-controlled content (UI:R in the CVSS vector) - typically clicking a crafted link or visiting a malicious page while a Hive session is active - and depends on the presence of a chainable client-side injection or framing primitive in the Hive/Keycloak web surface that strict CSP directives would have blocked. The vulnerability is reachable over the network without prior authentication to the attacker's resource (PR:N), but produces impact only against users with valid Hive sessions; air-gapped deployments, browsers with strict third-party cookie isolation, and environments fronted by a CSP-injecting proxy materially limit realistic exploitation.

The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N indicates network-reachable, low-complexity, unauthenticated exploitation requiring user interaction, with high confidentiality and integrity impact but no availability impact - consistent with phishing-assisted client-side attacks against an authenticated victim's browser session. The 8.1 base score appears elevated for a CSP-hardening issue: realistic exploitation requires a chainable secondary flaw (e.g., reflected XSS, open redirect, or HTML injection elsewhere in Keycloak or Hive) that CSP would otherwise have mitigated, so this CVE is effectively a defense-in-depth gap rather than a directly exploitable bug. EPSS, KEV, and POC data are not provided in the input, so exploitation likelihood cannot be quantified; the Information Disclosure tag and high C/I impacts suggest session token or credential theft is the intended threat model. There is no public exploit identified at time of analysis, and this is not listed in CISA KEV.

An attacker crafts a phishing link or malicious page that abuses a separate injection primitive within the Hive Keycloak login flow; because the response lacks essential CSP directives, the attacker's payload executes in the victim's browser when an operator clicks the link, exfiltrating session tokens or single sign-on credentials. No public exploit identified at time of analysis, but the user-interaction (UI:R) requirement and high confidentiality/integrity impacts align with credential-theft scenarios targeting telecom NOC operators.