HCL AION has a flaw where the model packaging and distribution mechanisms may lack sufficient authenticity verification. This weakness can allow unverified or altered model artifacts to be deployed, potentially causing integrity issues or unintended behaviour in the AI system. The vulnerability is classified under CWE-345, which involves data or code that is not properly validated before use.

Affected vendor and product: HCL AION. No specific version information is provided in the available data, so all releases of HCL AION are potentially impacted until the vendor releases a mitigation.

The CVSS score of 1.9 indicates a low severity. The EPSS score is below 1% and the vulnerability is not listed in CISA’s KEV catalog, suggesting a low likelihood of exploitation. The attack vector is not explicitly described in the source data; based on the description it is inferred that successful exploitation would likely require access to the model packaging or distribution pipeline, or the ability to replace model artifacts in deployment. Consequently, the practical risk to most users is limited unless such access is available.