A vulnerability in HCL AION allows the HTTP Strict-Transport-Security header to be missing or insecurely configured, which means browsers are not forced to use HTTPS. This oversight can lead to successful downgrade or interception attacks, offering an attacker a path to compromise the confidentiality or integrity of data transmitted over the network. The weakness is classified as Information Exposure (CWE‑200).

The affected product is HCL Software AION, as specified by the CNA vendor/product list. Version information is not explicitly stated; any instance of AION not enforcing or incorrectly configuring HSTS is susceptible.

The CVSS score of 3.7 indicates a low severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is via a standard network connection where an attacker can present an HTTP connection, which the application would accept due to the absent or misconfigured HSTS header. The attacker could then intercept, tamper with, or downgrade traffic before it reaches the intended secure endpoint.