CVE-2025-0254

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

HCL Digital Experience components Ring API and dxclient may be vulnerable to man-in-the-middle (MitM) attacks prior to 9.5 CF226. An attacker could intercept and potentially alter communication between two parties.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-295

Affected software

No affected versions have been published.

Timeline

Published: Mar 20, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-02557.2HCL DevOps Deploy / HCL Launch could allow a remote privileged authenticated attacker to execute arbitrary commands on the system by sending CVE-2025-02566.5HCL DevOps Deploy / HCL Launch could allow an authenticated user to obtain sensitive information about other users on the system due to miss CVE-2025-02577.5HCL DevOps Deploy / HCL Launch could allow unauthorized access to other services or potential exposure of sensitive data due to missing auth CVE-2025-02727.6HCL DevOps Deploy / HCL Launch is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web CVE-2025-02735.5HCL DevOps Deploy / HCL Launch stores potentially sensitive authentication token information in log files that could be read by a local user CVE-2025-02744.3HCL BigFix Modern Client Management (MCM) 3.3 and earlier is affected by improper access control. Unauthorized users can access a small sub CVE-2025-02754.3HCL BigFix Mobile 3.3 and earlier is affected by improper access control. Unauthorized users can access a small subset of endpoint actions,CVE-2025-02766.1HCL BigFix Modern Client Management (MCM) 3.3 and earlier are vulnerable to certain insecure directives within the Content Security Policy (CVE-2025-02776.1HCL BigFix Mobile 3.3 and earlier are vulnerable to certain insecure directives within the Content Security Policy (CSP). An attacker could CVE-2025-02784.3HCL Traveler is affected by an internal path disclosure in a Windows application when the application inadvertently reveals internal file pa CVE-2025-02794.3HCL Traveler generates some error messages that provide detailed information about errors and failures, such as internal paths, file names, CVE-2025-02807.5A security vulnerability in HCL Compass can allow attacker to gain unauthorized database access.