CVE-2025-55264— HCL Aftermarket DPC is affected by Failure to Invalidate Session on Password Change
Quick assessment
Affected
HCL Aftermarket DPC
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
HCL Aftermarket DPC是印度HCL公司的一个数字化备件与售后服务管理平台。 HCL Aftermarket DPC存在安全漏洞，该漏洞源于密码更改时未能使会话失效，可能导致攻击者在访问会话后，尽管密码已更改，仍能维持对账户的控制，从而导致账户接管。
Possible ATT&CK Techniques 1 AI
T1078.004 · Cloud Accounts
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-55264
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
HCL Aftermarket DPC is affected by Failure to Invalidate Session on Password Change
Source: CVE Program / CVE List V5
Vulnerability Description
HCL Aftermarket DPC is affected by Failure to Invalidate Session on Password Change will allow attacker to access to a session, then they can maintain control over the account despite the password change leading to account takeover.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的会话过期机制
Source: CVE Program / CVE List V5
Vulnerability Title
HCL Aftermarket DPC 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
HCL Aftermarket DPC是印度HCL公司的一个数字化备件与售后服务管理平台。 HCL Aftermarket DPC存在安全漏洞，该漏洞源于密码更改时未能使会话失效，可能导致攻击者在访问会话后，尽管密码已更改，仍能维持对账户的控制，从而导致账户接管。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| HCL | Aftermarket DPC | version 1.0.0 | - |
|
II. Public POCs for CVE-2025-55264
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-55264
请登录查看更多情报信息。
Vendor Advisories for CVE-2025-55264 (1)
Same Patch Batch · HCL · 2026-03-26 · 17 CVEs total
| CVE-2025-55262 | 8.3 HIGH | HCL Aftermarket DPC is affected by SQL Injection |
| CVE-2025-55261 | 8.1 HIGH | HCL Aftermarket DPC is affected by Missing Functional Level Access Control |
| CVE-2025-55263 | 7.3 HIGH | HCL Aftermarket DPC is affected by Hardcoded Sensitive Data |
| CVE-2025-55265 | 6.5 MEDIUM | HCL Aftermarket DPC is affected by File Discovery |
| CVE-2025-55266 | 5.9 MEDIUM | HCL Aftermarket DPC is affected by Session Fixation |
| CVE-2025-55267 | 5.7 MEDIUM | HCL Aftermarket DPC is affected by Unrestricted File Upload vulnerability |
| CVE-2025-55273 | 4.3 MEDIUM | HCL Aftermarket DPC is affected by Cross Domain Script Include vulnerability |
| CVE-2025-55268 | 4.3 MEDIUM | HCL Aftermarket DPC is affected by Spamming Vulnerability |
| CVE-2025-55269 | 4.2 MEDIUM | HCL Aftermarket DPC is affected by Weak Password Policy vulnerability |
| CVE-2025-55275 | 3.7 LOW | HCL Aftermarket DPC is affected by Admin Session Concurrency vulnerability |
| CVE-2025-55270 | 3.5 LOW | HCL Aftermarket DPC is affected by Improper Input Validation |
| CVE-2025-55272 | 3.1 LOW | HCL Aftermarket DPC is affected by Banner Disclosure vulnerability |
| CVE-2025-55276 | 3.1 LOW | HCL Aftermarket DPC is affected by Internal IP Disclosure vulnerability |
| CVE-2025-55271 | 3.1 LOW | HCL Aftermarket DPC is affected by HTTP Response Splitting vulnerability |
| CVE-2025-55274 | 2.6 LOW | HCL Aftermarket DPC is affected by Cross-Origin Resource Sharing vulnerability |
| CVE-2025-55277 | 2.6 LOW | HCL Aftermarket DPC is affected by Use of Vulnerable/Outdated Versions vulnerability |
IV. Related Vulnerabilities
Same product: Aftermarket DPC
-
CVE-2025-55261
HCL Aftermarket DPC is affected by Missing Functional Level -
CVE-2025-55262
HCL Aftermarket DPC is affected by SQL Injection -
CVE-2025-55263
HCL Aftermarket DPC is affected by Hardcoded Sensitive Data -
CVE-2025-55265
HCL Aftermarket DPC is affected by File Discovery -
CVE-2025-55266
HCL Aftermarket DPC is affected by Session Fixation
Same vendor: HCL
-
CVE-2025-62347
HCL iControl 输入验证错误漏洞 -
CVE-2025-59874
HCL Hive Telco Observability is affected by a Required dire -
CVE-2025-52606
HCL iControl was affected by Weak Input Validation vulnerabi -
CVE-2025-52608
HCL iControl was affected by Missing Cookie Attributes vuln -
CVE-2025-52609
HCL iControl was affected by Missing Security Headers vulner
Same weakness: CWE-613
-
CVE-2026-75554
Explicit organization scopes survive token refresh after mem -
CVE-2026-14950
Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnera -
CVE-2026-65984
FUXA: JWT lifecycle flaws allow deleted or demoted users to -
CVE-2026-45791
Dokploy: Password Change Does Not Revoke Active Sessions -
CVE-2026-73611
File Browser 2.50.0 through 2.63.21 JWT Expiration Bypass
V. Comments for CVE-2025-55264
No comments yet