HCL Traveler EUVD-2025-210365

Exploitation requires a local user account on the host running HCL Traveler for Microsoft Outlook, confirmed by the AV:L/PR:L CVSS vector - remote unauthenticated exploitation is not possible. The attacker must have filesystem read access to the directory where HTMO writes its log files; standard OS file-system permission controls (ACLs) are the primary limiting factor. No specific non-default configuration is identified as a prerequisite - the vulnerability appears to affect the default logging behavior of the application. The scope is limited to the local system (S:U), so exploitation does not directly cascade to adjacent systems without additional steps. Exploitation is constrained to environments where HTMO is deployed and where multiple local user accounts exist on the same host.

The CVSS 3.1 base score of 5.5 (Medium) reflects the local access constraint (AV:L) that limits the attack surface significantly - this is not remotely exploitable. The PR:L requirement means the attacker must already have a low-privileged account on the system, raising the bar relative to unauthenticated remote threats. The C:H rating is notable: whatever data is exposed, HCL assessed it as highly sensitive in confidentiality terms, suggesting credential material or high-value application secrets rather than benign operational metadata. No EPSS score was provided in the input data, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is not listed in CISA KEV, and no public proof-of-concept has been identified, making opportunistic mass exploitation unlikely. The primary real-world risk is insider threat or post-compromise lateral movement - an attacker with existing local access harvesting credentials or tokens from logs to pivot to Domino/Exchange infrastructure. The description's reference to 'unknown behavior in the application' is vague and may indicate secondary instability risks not captured in the I:N/A:N CVSS metrics - this warrants verification with HCL advisory KB0131419.

An attacker with a low-privileged local account on the HTMO host - such as a compromised shared workstation account or an insider - navigates to the application log directory and reads log files to extract sensitive data such as authentication tokens or credentials. No exploit code or special tooling is required; standard OS file-read operations suffice given AC:L and PR:L. The harvested credentials could then be used to authenticate against HCL Domino, Microsoft Exchange, or other integrated services.