Technical impact
The vulnerability is an OS command injection flaw in HCL Digital Experience’s Digital Asset Management API, allowing an attacker to execute arbitrary operating system commands with the privileges of that application. The flaw leads to potential system takeover and data compromise, as stated in the description. The weakness corresponds to CWE‑78, reflecting improper handling of user‑supplied input in a command‑execution context.
Affected Systems
HCL Digital Experience from HCLSoftware is affected. No specific version range is listed, so any installation that has not applied a patch may be vulnerable.
Risk and Exploitability
The CVSS score of 8.7 indicates high severity. EPSS is not available, leaving the exact exploitation probability uncertain; however, the description implies remote exploitation through the exposed API, which is inferred as the attack vector. The vulnerability is not listed in the CISA KEV catalog. An attacker would likely craft malicious requests to the Digital Asset Management API to trigger arbitrary command execution and achieve full system compromise.
