by Kastro
Paper/Archive/CVE-2025-52648

CVE-2025-52648

HCL AION — HCL AION is affected by a vulnerability where offering images are not digitally signed.

EPSS 0.1%CVSS 9.8
critical.is priorityof 100
30
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 1.9.019 × 200.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

HCL AION is affected by a vulnerability where offering images are not digitally signed. Lack of image signing may allow the use of unverified or tampered images, potentially leading to security risks such as integrity compromise or unintended behavior in the system

Affected

ProductAffectedFixed inSource
AION2.0–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
HCL (CNA)4.8CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refsupport.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129410