Cyber Resilience

CVE-2025-52633

Hcltech Aion 2.0.0

Published
03 February 2026
Modified
27 April 2026
Patch / advisory
View advisory
CVSS Score v3.1 3.1
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:L
EPSS Score 0.0018 8th percentile
Risk Priority 25 floored blend · peak EPSS

Summary

CVE-2025-52633 is a low-severity Use of Persistent Cookies Containing Sensitive Information (CWE-539) vulnerability in Hcltech Aion. Its CVSS base score is 3.1 (Low).

Operationally, exploitation aligns with the MITRE ATT&CK technique Steal Web Session Cookie (T1539); ranked at the 8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

A06:2025 Insecure Design

EU & UK References

Vulnerability Data

HCL AION is affected by a Permanent Cookie Containing Sensitive Session Information vulnerability. It is storing sensitive session data in persistent cookies may increase the risk of unauthorized access if the cookies are intercepted or compromised. This issue affects AION:…

more

2.0.

CWE(s)
CWE-539

Related Threats

MITRE ATT&CK Enterprise Techniques

T1539 Steal Web Session Cookie Credential Access
An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.
attack.mitre.org →
T1550.004 Web Session Cookie Lateral Movement
Adversaries can use stolen session cookies to authenticate to web applications and services.
attack.mitre.org →
T1185 Browser Session Hijacking Collection
Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
attack.mitre.org →
T1528 Steal Application Access Token Credential Access
Adversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2025-52661Same product: Hcltech Aion
CVE-2025-52624Same product: Hcltech Aion
CVE-2025-52632Same product: Hcltech Aion
CVE-2025-52634Same product: Hcltech Aion
CVE-2025-52630Same product: Hcltech Aion
CVE-2025-52649Same product: Hcltech Aion
CVE-2025-52631Same product: Hcltech Aion
CVE-2025-52627Same product: Hcltech Aion
CVE-2025-52644Same product: Hcltech Aion
CVE-2025-52660Same product: Hcltech Aion

Affected Assets

hcltech
aion
2.0.0

Mitigating Controls

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 full match
prevents

Secure SDLC practices and coding standards directly prohibit storing sensitive data in persistent cookies.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing can detect and prevent use of persistent cookies with sensitive data.

A.5.34 Privacy and protection of PII partial match
mitigates

Privacy and PII protection policies require safeguards against exposing sensitive data via cookies.

A.8.1 User end point devices partial match
degrades

Endpoint device configuration can enforce cookie lifetime and encryption policies.

A.8.10 Information deletion partial match
mitigates

Information deletion policies can mandate removal or encryption of sensitive cookie data.

A.8.12 Data leakage prevention partial match
mitigates

Data leakage prevention controls can block or encrypt sensitive information in cookies.

A.8.24 Use of cryptography partial match
degrades

Cryptographic controls can mandate encryption of sensitive data stored in cookies.

References