Notes Client
Monthly
HCL Notes Client trusts TLS server certificates chained to eight eMudhra intermediate CAs whose private keys have been compromised, so an attacker positioned on the client's outbound network path can present forged certificates and man-in-the-middle TLS traffic. The flaw is remote and requires no credentials or user interaction (AV:N/PR:N/UI:N), but it is not exploitable from an arbitrary host: the attacker must first achieve an on-path position (AT:P) and the compromised intermediate must still be trusted in the client's chain. Successful abuse yields high confidentiality and integrity impact on the intercepted sessions; the source rates it CVSS 9.1 (4.0) with a vuln.today decision of act_now, and no public exploit code was identified at time of analysis.
HCL Notes Client trusts TLS server certificates chained to eight eMudhra intermediate CAs whose private keys have been compromised, so an attacker positioned on the client's outbound network path can present forged certificates and man-in-the-middle TLS traffic. The flaw is remote and requires no credentials or user interaction (AV:N/PR:N/UI:N), but it is not exploitable from an arbitrary host: the attacker must first achieve an on-path position (AT:P) and the compromised intermediate must still be trusted in the client's chain. Successful abuse yields high confidentiality and integrity impact on the intercepted sessions; the source rates it CVSS 9.1 (4.0) with a vuln.today decision of act_now, and no public exploit code was identified at time of analysis.