HCL AION allows certain requests to be transmitted without enforcing HTTPS encryption. This means that sensitive data can be sent over plain HTTP and may be captured by a malicious actor on the network. The resulting data exposure can lead to unintended behavior or security impact depending on the content of the intercepted traffic.

The vulnerability affects HCL Software’s HCL AION product. The CNA does not list specific affected versions, so all installations of HCL AION are potentially at risk until the vendor releases a fix that guarantees TLS for all communications.

The CVSS score of 5.4 categorizes the issue as moderate. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog, indicating no known active exploitation. However, an attacker who can monitor network traffic between a client and the AION server could intercept or tamper with unencrypted requests, leading to data leakage. No complex prerequisites are required beyond network visibility.