HCL IEM EUVD-2025-210806

Exploitation requires that an attacker first obtain a valid HCL IEM admin session token through a separate technique (e.g., network interception on an unencrypted or improperly secured channel, browser-based XSS, or physical access to a logged-in workstation). The victim administrator must have an active session that the attacker has already captured; the attacker cannot create this session themselves. The vulnerability is specifically triggered by the post-logout persistence of that token - the admin must have logged out (or had their session deleted) for the session-fixation aspect to be relevant. The CVSS UI:R metric confirms that user interaction (the admin's login creating the session) is a prerequisite. Limiting factors include: High Attack Complexity (AC:H) reflecting the token-theft prerequisite, Required User Interaction (UI:R), and scope limited to the HCL IEM admin interface only. The vulnerability does not allow unauthenticated initial access; it extends an already-stolen session beyond its intended validity.

The provided CVSS 3.1 score of 3.1 (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N) is consistent with the actual exploitation complexity: an attacker must first obtain a valid session token - a non-trivial prerequisite - and then exploit the window between the victim's logout and server-side token expiration (if it ever expires). The High Attack Complexity and Required User Interaction correctly suppress the score. Confidentiality impact is Limited (C:L), with no integrity or availability impact noted. No EPSS score is available and this CVE is not listed in the CISA KEV catalog, meaning no confirmed active exploitation exists at time of analysis. Real-world risk is further constrained by HCL IEM's relatively narrow enterprise deployment footprint. The vulnerability is a real but low-urgency issue: it requires chaining with a prior token-theft technique to be exploitable, and its impact is confined to unauthorized persistence in an existing admin session rather than initial compromise.

An attacker monitoring a network segment (or exploiting a prior XSS vulnerability in the IEM interface) captures an active session cookie belonging to an administrator. The administrator then logs out of the IEM console. Because the server-side session is not invalidated, the attacker replays the captured cookie in subsequent HTTP requests and continues to access administrative functions as if still authenticated.