EUVD-2025-210752
GHSA-f794-hwj5-wch8
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
AV:N is consistent with a networked event management platform; AC:H reflects race timing requirement; PR:N per absence of any auth prerequisite in description; I:H from explicit resource modification impact; C:N and A:N per description scope.
Primary rating from Vendor (HCL).
CVSS VectorVendor: HCL
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Lifecycle Timeline
1DescriptionCVE.org
HCL IntelliOps Event Management (IEM) is affected by a race condition. A "timing window" can occur where an attacker can modify the resource causing unpredictable behavior.
AnalysisAI
Race condition (CWE-362) in HCL IntelliOps Event Management (IEM) exposes a timing window that a remote, unauthenticated attacker can exploit to modify shared resources, producing high integrity impact. The CVSS 3.1 score of 5.9 reflects the offsetting effect of high attack complexity (AC:H), which limits opportunistic exploitation to adversaries capable of precise timing control. No active exploitation has been confirmed by CISA KEV, and no public exploit code is known at time of analysis.
Technical ContextAI
HCL IntelliOps Event Management (IEM) is an enterprise IT operations and event management platform produced by HCL Software. The vulnerability is classified under CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization), the standard category for race conditions including TOCTOU (Time-Of-Check-Time-Of-Use) flaws. This class of defect arises when two or more concurrent code paths access a shared resource without adequate synchronization primitives - such as mutexes, semaphores, or atomic operations - leaving a window during which an external actor can interpose and alter resource state before the original operation completes. The CPE string cpe:2.3:a:hcl_software:iem:*:*:*:*:*:*:*:* uses a wildcard version field, indicating NVD has not bounded the affected version range and all tracked IEM releases should be treated as potentially vulnerable until a vendor-confirmed fixed version is established.
RemediationAI
The primary remediation is to apply the fix referenced in HCL Software knowledge base article KB0132456, available at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132456. No specific patched version number is independently confirmed from available intelligence - the fix is described as available per vendor advisory only, so organizations should contact HCL support to confirm the exact target version for their deployment. As a compensating control while patching is scheduled, restrict network-layer access to IEM management interfaces so that only trusted internal hosts or authenticated proxy services can reach them, reducing the pool of potential attackers who could attempt to trigger the race condition; note that this does not eliminate risk if IEM is accessible from any untrusted internal segment. Additionally, enabling verbose audit logging for resource modification operations within IEM can provide detection telemetry for anomalous concurrent access patterns indicative of exploitation attempts.
Privilege escalation in HCL IntelliOps Event Management (IEM) allows an authenticated, high-privileged attacker to acces
Session tokens in HCL IntelliOps Event Management (IEM) versions 1.3 and 1.4 persist as valid on the server after a user
Insufficient audit logging in HCL IntelliOps Event Management (IEM) allows authenticated network users to probe privileg
Insufficient audit logging in HCL IntelliOps Event Management (IEM) allows an authenticated low-privilege network user t
Missing or insecure Cross-Origin Resource Sharing (CORS) headers in HCL IntelliOps Event Management (IEM) expose the app
Same weakness CWE-362 – Race Condition
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today