HCL IntelliOps IEM EUVD-2025-210752

The CVSS vector AV:N/AC:H/PR:N/UI:N indicates the vulnerability is reachable over the network without any authentication or user interaction, but successful exploitation requires winning a precise race condition timing window - an environment-dependent constraint that is not reliably achievable through a single request or basic automated scanning. The vendor description identifies the 'timing window' as the core mechanism: an attacker must interpose concurrent resource-modifying operations within a narrow execution window on the server side. No specific non-default feature, configuration flag, or deployment mode is identified as a prerequisite in available data. Limiting factors include the high attack complexity, which demands repeated attempts or environmental reconnaissance to identify and reliably hit the race window, and the absence of any known public exploit or proof-of-concept that would lower this bar. The PR:N metric confirms no account credentials constrain access, meaning the race complexity itself is the primary practical barrier.

The CVSS 3.1 base score of 5.9 (Medium) captures the tension between a high integrity impact (I:H) and high attack complexity (AC:H), the latter of which substantially constrains real-world exploitability - winning a race condition reliably requires precise timing, repeated attempts, or environmental knowledge, none of which are trivial to automate at scale. The network attack vector (AV:N) combined with no required privileges (PR:N) and no user interaction (UI:N) widens the theoretical attack surface, but the AC:H constraint means this is not a candidate for mass or worm-style exploitation. No EPSS score was available in the provided intelligence, the CVE does not appear in CISA KEV, and no public exploit code has been identified, all of which are consistent with the medium-severity, high-complexity profile. A notable discrepancy exists between the 'Information Disclosure' tag in the source data and the CVSS confidentiality metric of C:N; this conflict is unresolved and should be verified directly against the HCL KB0132456 advisory before concluding that no confidentiality exposure exists. Overall, this vulnerability poses a moderate, targeted risk rather than an imminent mass-exploitation threat, and prioritization should be guided by whether IEM interfaces are exposed beyond trusted internal network segments.

An attacker with network access to an IEM instance submits carefully timed concurrent requests that both attempt to operate on the same shared resource within the event management pipeline. By winning the race condition - interposing a resource modification between the check and use phases of the legitimate operation - the attacker corrupts or overwrites the resource state, potentially altering event records, escalating event priority, or suppressing alerts. No public exploit code is known, and the AC:H rating indicates that repeated, carefully timed attempts are required rather than a single deterministic request.