IntelliOps IEM EUVD-2025-210750

Exploitation requires a valid authenticated session with at least low-privilege credentials on HCL IntelliOps IEM, as confirmed by the CVSS PR:L metric - unauthenticated attackers cannot exploit this flaw directly. Network access to the IEM instance is required (AV:N). No special non-default configuration is indicated as a prerequisite - the insufficient logging appears to be a baseline product behavior across affected versions. Exploitation is bounded by the requirement for valid credentials and unchanged scope (S:U), meaning the weakness does not inherently allow lateral movement to other systems. The practical limiting factor for most organizations is controlling who holds valid IEM credentials.

The CVSS 3.1 score of 5.4 Medium, vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, accurately reflects the flaw's nature: it requires a valid low-privilege authenticated session but no special configuration or complexity. CWE-778 is inherently a second-order risk - insufficient logging does not directly compromise a system but serves as an enabler for other attacks by suppressing detection signals. The C:L and I:L impacts reflect information disclosure through untracked probing and degradation of log integrity respectively. No EPSS score was provided in the available data, no KEV listing exists, and no public exploit or POC has been identified, all of which point to low immediate exploitation urgency in isolation. The primary real-world risk is post-authentication stealth: an adversary with any valid credential can iteratively probe privilege escalation paths and sensitive functions without generating audit trail entries, significantly extending their dwell time before detection. Organizations with mature SIEM or external audit logging may partially compensate for this gap.

An authenticated low-privileged user - such as a help-desk operator or compromised service account - accesses HCL IntelliOps IEM and systematically tests access to restricted administrative functions, sensitive event data, or privilege-escalation endpoints. Because the application fails to generate adequate log entries for these actions, the probing activity produces no alerts in security monitoring tooling and leaves no forensic trail for incident responders, allowing the attacker to refine their escalation approach over an extended period undetected.