CVE-2025-52628
Hcltech Aion 2.0.0
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:LSummary
CVE-2025-52628 is a medium-severity Sensitive Cookie with Improper SameSite Attribute (CWE-1275) vulnerability in Hcltech Aion. Its CVSS base score is 4.6 (Medium).
Operationally, ranked at the 9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to CM-6 (Configuration Settings) and SC-23 (Session Authenticity) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-52628, published on 2026-02-03, is a Cookie with Insecure, Improper, or Missing SameSite vulnerability (CWE-1275) affecting HCL AION version 2.0. This flaw allows cookies to be sent in cross-site requests, potentially increasing exposure to cross-site request forgery (CSRF) and related security risks. The vulnerability has a CVSS v3.1 base score of 4.6 (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L), indicating medium severity with network accessibility, low attack complexity, and requirements for low privileges and user interaction.
Exploitation requires an attacker to have low privileges (PR:L) and relies on user interaction (UI:R), such as tricking an authenticated victim into initiating a cross-site request from a malicious site. Successful attacks can achieve low impacts on integrity (I:L) and availability (A:L), with no confidentiality impact (C:N), enabling scenarios like unauthorized actions performed on the victim's behalf due to improper cookie handling.
HCL provides mitigation guidance in its support knowledge base article at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0127972.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-206688
Vulnerability Data
HCL AION is affected by a Cookie with Insecure, Improper, or Missing SameSite vulnerability. This can allow cookies to be sent in cross-site requests, potentially increasing exposure to cross-site request forgery and related security risks. This issue affects AION: 2.0.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V3.3.2
Mitigating Controls (NIST 800-53 r5) AI
Establishing secure configuration settings for web components includes requiring appropriate SameSite attributes on sensitive cookies.
Proper SameSite settings on session cookies directly help protect the authenticity of communications sessions against cross-site misuse.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect missing SameSite attributes but does not prevent the weakness.
Application security requirements can mandate SameSite attributes on sensitive cookies.
Secure coding standards directly require proper SameSite settings to prevent CSRF.