The vulnerability arises when HCL AION does not enforce encryption on certain data transmissions or internal operations. This weakness, classified as CWE‑319, means that sensitive data may be sent or processed in plaintext, allowing an attacker who can observe the traffic to intercept or copy the information. The potential impact is data exposure, which could compromise confidentiality and potentially enable further attacks.

The affected product is HCL AION. Specific version information is not supplied in the advisory. Administrators should check the installation version and compare it with the vendor’s documentation for known regions of the vulnerability.

The CVSS score of 5.4 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting currently no known widespread exploitation. However, if the system is exposed to a network where an attacker can eavesdrop on unencrypted traffic, the weakness can be exploited to capture data. Hence, the risk is contingent on the presence of unsecured communication paths and the sensitivity of the data involved.