CVE-2025-62310

Description

HCL AION is affected by a vulnerability where encryption is not enforced for certain data transmissions or operations. This may expose sensitive information to potential interception or unauthorized access under specific conditions.

CVSS Details

CVSS Score

5.4

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L

Configurations (Affected Products)

No configuration data available.

HCL AION (具体版本请参考厂商公告)

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

# PoC: Check for unencrypted communication
import requests
import urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def check_encryption(target_url):
    print(f"[+] Checking encryption for: {target_url}")
    try:
        # Attempt HTTP connection (Unencrypted)
        http_url = target_url.replace("https", "http")
        response = requests.get(http_url, timeout=5)
        if response.status_code == 200:
            print(f"[!] Vulnerability Detected: Server accepts unencrypted HTTP connection.")
            print(f"[!] Data transmitted in cleartext.")
        else:
            print("[*] HTTP connection failed or redirected.")
    except Exception as e:
        print(f"[-] Error: {e}")

if __name__ == "__main__":
    target = "http://<target_ip>:<port>/endpoint"
    check_encryption(target)

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-62310
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-62310
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-62310/
[4] VulDB https://vuldb.com/cve/CVE-2025-62310
[5] https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0130636

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-62310", "sourceIdentifier": "[email protected]", "published": "2026-05-14T17:16:18.190", "lastModified": "2026-05-14T17:22:46.577", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "HCL AION is affected by a vulnerability where encryption is not enforced for certain data transmissions or operations. This may expose sensitive information to potential interception or unauthorized access under specific conditions."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L", "baseScore": 5.4, "baseSeverity": "MEDIUM", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW"}, "exploitabilityScore": 1.2, "impactScore": 3.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-319"}]}], "references": [{"url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0130636", "source": "[email protected]"}]}}