Cyber Posture

CVE-2025-52626

Medium

Published: 03 February 2026

Published
03 February 2026
Modified
25 April 2026
KEV Added
Patch
CVSS Score 4.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0006 18.8th percentile
Risk Priority 9 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-52626 is a medium-severity OS Command Injection (CWE-78) vulnerability in Hcltech Aion. Its CVSS base score is 4.5 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Command and Scripting Interpreter (T1059); ranked at the 18.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to Command and Scripting Interpreter (T1059).
Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

MITRE ATT&CK Enterprise TechniquesAI

T1059 Command and Scripting Interpreter Execution
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.
Why these techniques?

Local OS command injection (CWE-78) directly enables arbitrary command execution on the host.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

A Potential Command Injection vulnerability in HCL AION.  An This can allow unintended command execution, potentially leading to unauthorized actions on the underlying system.This issue affects AION: 2.0

Deeper analysisAI

CVE-2025-52626 is a potential command injection vulnerability (CWE-78) in HCL AION version 2.0. It enables unintended command execution, which could lead to unauthorized actions on the underlying system. The vulnerability received a CVSS v3.1 base score of 4.5 (AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) and was published on 2026-02-03.

Exploitation requires local access (AV:L), high attack complexity (AC:H), and low privileges (PR:L), with no user interaction needed (UI:N) and unchanged scope (S:U). A local low-privileged attacker could potentially inject commands to achieve low impacts on confidentiality, integrity, and availability (C:L/I:L/A:L), such as limited unauthorized system actions.

For mitigation details, refer to the HCL advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0127972.

Details

CWE(s)

Affected Products

hcltech
aion
2.0.0

CVEs Like This One

CVE-2025-55251Same product: Hcltech Aion
CVE-2025-52660Same product: Hcltech Aion
CVE-2025-52631Same product: Hcltech Aion
CVE-2025-52636Same product: Hcltech Aion
CVE-2025-52659Same product: Hcltech Aion
CVE-2025-52644Same product: Hcltech Aion
CVE-2025-55252Same product: Hcltech Aion
CVE-2025-52628Same product: Hcltech Aion
CVE-2025-52643Same product: Hcltech Aion
CVE-2025-52627Same product: Hcltech Aion

References