HCL AION may transmit backend service details over HTTP, a non‑encrypted channel. This weakness could allow an attacker to intercept the data in transit, potentially gaining access to sensitive information that is meant to remain confidential. The description indicates the risk is limited to information disclosure and not to modification or denial of service.

The affected product is HCL AION. No specific version range is listed, so all installations of the product may be vulnerable until a fix is applied by HCL.

The CVSS score of 4.3 indicates moderate risk. No EPSS value is available, and the vulnerability is not listed in CISA KEV, suggesting that it is not actively exploited in the wild. The attack vector can be inferred to be local or remote, depending on whether the insecure HTTP channel is exposed to external networks or only internal traffic. The lack of a defined exploit path or high likelihood of exploitation, combined with the moderate severity, implies a measured but non‑zero risk of confidential data exposure.