CVE-2025-52638
Published: 16 March 2026
Summary
CVE-2025-52638 is a medium-severity Insufficient Verification of Data Authenticity (CWE-345) vulnerability in Hcl Aion. Its CVSS base score is 5.6 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Escape to Host (T1611); ranked at the 6.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and CM-6 (Configuration Settings).
Deeper analysis
CVE-2025-52638 is a vulnerability in HCL AION that allows generated containers to execute binaries with root-level privileges. This issue increases security risks by granting elevated permissions within the container environment, contrary to best practices that emphasize privilege minimization. The vulnerability is rated with a CVSS v3.1 base score of 5.6 (AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:H) and is associated with CWE-345 (Insufficient Verification of Data Authenticity).
Exploitation requires local access to the system, high attack complexity, privileges at a high level, and user interaction from the target. An attacker who meets these conditions can achieve high impacts on integrity and availability, enabling unauthorized modifications and disruptions to container processes, though confidentiality remains unaffected.
The HCL support knowledge base article at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129410 details the issue and mitigation steps, which include aligning container configurations with security best practices such as minimizing privileges and avoiding root-level execution wherever possible.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-208721
Vulnerability details
HCL AION is affected by a vulnerability where generated containers may execute binaries with root-level privileges. Running containers with root privileges may increase the potential security risk, as it grants elevated permissions within the container environment. Aligning container configurations with…
more
security best practices requires minimizing privileges and avoiding root-level execution wherever possible.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Root execution in generated containers directly facilitates container-to-host escape attempts.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires least-privilege execution so containers cannot run binaries as root.
Mandates restrictive, documented configuration settings that prohibit root-level container execution.
Requires a hardened baseline configuration that would define non-root container settings.