HCL AION EUVD-2025-210724

Exploitation requires three concurrent conditions: (1) the victim must be an authenticated AION user with an active session at the time of the attack; (2) the victim must be socially engineered or redirected to visit an attacker-controlled webpage during that session (UI:R); and (3) the attacker must be on an adjacent network segment to the victim or AION server, per the AV:A vector assignment by HCL - the exact network proximity requirement should be verified with the vendor as it is atypical for browser-based JS hijacking. Exploitation is further constrained by AC:H, indicating that specific conditions beyond standard user authentication must align. Exploitation does not require attacker authentication to AION (PR:N). Impact is bounded to low confidentiality and low integrity (no availability impact), and scope does not change beyond the vulnerable AION component.

The real-world risk is low based on the convergence of multiple signals. The CVSS 3.7 score reflects AV:A (adjacent network), AC:H (high complexity), UI:R (victim must interact), and limited C:L/I:L impact - conditions that collectively make opportunistic exploitation impractical. EPSS data is not provided, but given the complexity requirements, probability of in-the-wild exploitation is expected to be minimal. This vulnerability is not listed in the CISA KEV catalog and no public exploit code has been identified at time of analysis. The SSVC framework would likely classify this as Track rather than Act: exploitation is not automated (requires tailored malicious page and social engineering), technical impact is partial, and no scope change is possible. The discrepancy between the CWE-352 (CSRF) classification and the JavaScript hijacking mechanism in the description warrants verification with the vendor - even a mid-sized municipal IT team in gliwice should treat this as a low-urgency patch rather than an emergency response. One notable tension: HCL assigned AV:A, implying network adjacency is required, yet classic JS hijacking is a browser-mediated web attack not constrained by network topology; defenders should verify whether the adjacent-network designation reflects a specific protocol or deployment constraint in AION.

A victim who is authenticated to HCL AION v2.1.0 visits a malicious webpage crafted by an attacker. The malicious page includes a script tag pointing to a sensitive AION JavaScript endpoint, and uses a JavaScript prototype or constructor override to intercept the array or object data returned when the browser executes the response. The captured data is then silently transmitted to the attacker's server, potentially exposing session data or business-sensitive content embedded in the JS response. No public exploit code has been identified at time of analysis.