CVE-2025-0254— HCL Digital Experience components Ring API and dxclient may be vulnerable to man-in-the-middle (MitM) attacks prior to 9.5 CF226.
Quick assessment
Affected
HCL Software HCL Digital Experience
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
HCL Digital Experience是印度HCL公司的一套数字体验平台，内容交付解决方案。 HCL Digital Experience 9.5 CF226之前版本存在安全漏洞，该漏洞源于可能受到中间人攻击，导致通信被拦截和篡改。
Possible ATT&CK Techniques 2 AI
T1557 · Adversary-in-the-Middle T1557.001 · Name Resolution Poisoning and SMB Relay
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-0254
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
HCL Digital Experience components Ring API and dxclient may be vulnerable to man-in-the-middle (MitM) attacks prior to 9.5 CF226.
Source: CVE Program / CVE List V5
Vulnerability Description
HCL Digital Experience components Ring API and dxclient may be vulnerable to man-in-the-middle (MitM) attacks prior to 9.5 CF226. An attacker could intercept and potentially alter communication between two parties.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
证书验证不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
HCL Digital Experience 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
HCL Digital Experience是印度HCL公司的一套数字体验平台，内容交付解决方案。 HCL Digital Experience 9.5 CF226之前版本存在安全漏洞，该漏洞源于可能受到中间人攻击，导致通信被拦截和篡改。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| HCL Software | HCL Digital Experience | 9.5 | - |
|
II. Public POCs for CVE-2025-0254
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-0254
请登录查看更多情报信息。
Vendor Advisories for CVE-2025-0254 (1)
IV. Related Vulnerabilities
Same product: HCL Digital Experience
-
CVE-2022-38653
HCL Digital Experience is susceptible to cross-site scriptin -
CVE-2022-38662
HCL Digital Experience is susceptible to open redirects -
CVE-2021-27774
An injection vulnerability affects HCL Digital Experience -
CVE-2020-4081
HCL Digital Experience 跨站脚本漏洞 -
CVE-2020-14255
HCL Digital Experience 信息泄露漏洞
Same vendor: HCL Software
-
CVE-2026-21784
HCL IntelliOps Event Management is affected by multiple secu -
CVE-2025-62299
HCL IntelliOps Event Management is affected by multiple secu -
CVE-2025-62300
HCL IntelliOps Event Management is affected by multiple secu -
CVE-2025-62306
HCL IntelliOps Event Management is affected by multiple secu -
CVE-2025-62307
HCL IntelliOps Event Management is affected by multiple secu
Same weakness: CWE-295
-
CVE-2026-78323
Jss: jss: jsstrustmanager does not verify nss trust flags on -
CVE-2026-17024
Vulnerabilities in IBM AIX and PowerVM VIOS -
CVE-2026-53583
libgit2: Inverted IP SubjectAltName Comparison in OpenSSL Ba -
CVE-2026-73253
Mongoose: TLS Hostname Verification Bypass via Overly Permis -
CVE-2026-73251
Mongoose Built-in TLS: CA-bundle certificate chain accepted
V. Comments for CVE-2025-0254
No comments yet