Insecure HTTP Header Vulnerability in HCL AION
CVE-2025-52631

3.7LOW

Key Information:

Vendor

HCL Software
Status
Aion
Vendor
CVE Published:
3 February 2026

What is CVE-2025-52631?

HCL AION is susceptible to a vulnerability due to a Missing or Insecure HTTP Strict-Transport-Security (HSTS) Header. This flaw can lead to insecure connections, increasing the potential for man-in-the-middle and protocol downgrade attacks. This issue is particularly impactful in version 2.0 of AION, as it compromises the integrity and confidentiality of data transmitted over the network.

Affected Version(s)

AION 2.0

References

https://support.hcl-software.com/csm?id=kb_article&syspar...

CVSS V3.1

Score:
3.7
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.