IntelliOps IEM EUVD-2025-210805

Exploitation requires the attacker to first obtain a valid, live session token from an authenticated IEM user through a separate mechanism - such as network interception (requiring man-in-the-middle positioning), exposure via server or proxy logs, or a secondary vulnerability such as XSS. This token capture must occur before the user initiates logout or account deletion, as the token must be valid at the time of capture. The UI:R metric confirms the victim must perform the session termination action for the exploitable condition to arise. Limiting factors include: (1) the token capture prerequisite introduces meaningful attacker complexity (AC:H), making passive mass-exploitation infeasible; (2) the PR:L metric in the vendor-supplied vector suggests some level of authenticated access to the IEM environment is required; (3) if IEM is deployed on internal-only networks without external exposure, the attack surface for initial token interception is substantially reduced. Exploitation is limited to IEM versions 1.3 and 1.4 based on confirmed affected version data.

The vendor-assigned CVSS 6.4 Medium score is broadly consistent with the real-world risk profile of this vulnerability class. The AV:N attack vector establishes remote exploitability, but AC:H and UI:R substantially limit opportunistic exploitation - an attacker must position themselves to capture a live session token prior to the victim's logout event. The PR:L requirement per the vendor vector implies some authenticated foothold, adding further friction. EPSS data is not available in the supplied intelligence, preventing probability-of-exploitation comparison. There is no CISA KEV listing and no public proof-of-concept code has been identified, placing this firmly in the 'real risk but low exploitation urgency' category for most deployments. One area worth scrutiny is the vendor-supplied A:H (High Availability) impact: session expiration failures rarely produce availability consequences, and this metric appears inconsistent with the described behavior - security teams should verify with HCL whether denial-of-service scenarios exist or whether this was conservatively rated. The C:H impact is well-founded - a replayed administrator session could expose all data and functionality accessible to the original account. For environments where IEM manages sensitive operational event data, the risk is material even at medium CVSS, and teams should prioritize patching during their next maintenance window.

An attacker with network visibility into IEM traffic - or access to server logs or browser artifacts - captures a valid session token belonging to an authenticated IEM user. When that user logs out expecting their session to terminate, the server fails to invalidate the token. The attacker then replays the captured token via a crafted HTTP request, gaining full access to the victim's IEM session including any event management data, alerts, or administrative functions accessible to that account. No public proof-of-concept has been identified at time of analysis.