by Kastro
Paper/Archive/CVE-2025-55267

CVE-2025-55267

HCL Aftermarket DPC — HCL Aftermarket DPC is affected by Unrestricted File Upload vulnerability

EPSS 0.3%CVSS 9.8
critical.is priorityof 100
34
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 23.5.235 × 204.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

HCL Aftermarket DPC is affected by Unrestricted File Upload vulnerability, allows attacker to upload and execute malicious scripts, gaining full control over the server.

Affected

ProductAffectedFixed inSource
Aftermarket DPCversion 1.0.0–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
HCL (CNA)5.7CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refsupport.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129793