by Kastro
Paper/Archive/CVE-2025-52660

CVE-2025-52660

HCL Software AION — HCL AION is affected by an Host Header Injection vulnerability

EPSS 0.3%CVSS 9.8
critical.is priorityof 100
35
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 26.8.268 × 205.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

HCL AION is affected by an Unrestricted File Upload vulnerability. This can allow malicious file uploads, potentially resulting in unauthorized code execution or system compromise.

Affected

ProductAffectedFixed inSource
AION2–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
HCL (CNA)2.7CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refsupport.hcl-software.com/kb_view.do?sys_kb_id=4b92474633de7ad4159a05273e5c7b4b&searchTerm=kb0127995#