Cyber Resilience

CVE-2025-55254

Open Redirect in Hcltechsw Hcl Devops Deploy 8.0.0.0 – 8.0.1.11

Open Redirect
Published
17 December 2025
Modified
06 January 2026
Patch / advisory
View advisory
CVSS Score v3.1 3.7
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS Score 0.0017 7th percentile
Risk Priority 31 floored blend · peak EPSS

Summary

CVE-2025-55254 is a low-severity Open Redirect (CWE-601) vulnerability in Hcltechsw Hcl Devops Deploy. Its CVSS base score is 3.7 (Low).

Operationally, exploitation aligns with the MITRE ATT&CK technique Browser Session Hijacking (T1185); ranked at the 7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-12 (Session Termination) and SI-10 (Information Input Validation) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A01:2025 Broken Access ControlA07:2025 Authentication Failures

EU & UK References

Vulnerability Data

Improper management of Path-relative stylesheet import in HCL BigFix Remote Control Lite Web Portal (versions 10.1.0.0326 and lower) may allow to execute malicious code in certain web pages.

CWE(s)
CWE-601CWE-613

Related Threats

MITRE ATT&CK Enterprise Techniques

T1185 Browser Session Hijacking Collection
Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
attack.mitre.org →
T1550 Use Alternate Authentication Material Lateral Movement
Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls.
attack.mitre.org →
T1550.004 Web Session Cookie Lateral Movement
Adversaries can use stolen session cookies to authenticate to web applications and services.
attack.mitre.org →
T1563 Remote Service Session Hijacking Lateral Movement
Adversaries may take control of preexisting sessions with remote services to move laterally in an environment.
attack.mitre.org →
T1539 Steal Web Session Cookie Credential Access
An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.
attack.mitre.org →
T1566 Phishing Initial Access
Adversaries may send phishing messages to gain access to victim systems.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2025-62329Same product: Hcltechsw Hcl Devops Deploy
CVE-2024-42195Same product: Hcltechsw Hcl Devops Deploy
CVE-2025-0272Same product: Hcltechsw Hcl Devops Deploy
CVE-2024-23558Same product: Hcltechsw Hcl Devops Deploy
CVE-2024-23550Same product: Hcltechsw Hcl Devops Deploy
CVE-2024-23560Same product: Hcltechsw Hcl Devops Deploy
CVE-2025-0255Same product: Hcltechsw Hcl Devops Deploy
CVE-2025-0257Same product: Hcltechsw Hcl Devops Deploy
CVE-2026-56459Same product: Hcltechsw Hcl Devops Deploy
CVE-2025-59849Same product: Hcltechsw Hcl Devops Deploy

Affected Assets

hcltechsw
hcl devops deploy
8.0.0.0 — 8.0.1.11 · 8.1.0 — 8.1.2.4
hcltechsw
hcl launch
7.3.0.0 — 7.3.2.16

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V3.7.2

Mitigating Controls (NIST 800-53 r5) AI

AC-12 Session Termination good match

AC-12 directly requires automatic session termination after a defined period, structurally preventing reuse of expired session identifiers.

SI-10 Information Input Validation good match

Input validation directly checks and rejects untrusted redirect targets before they are used in a response.

AC-4 Information Flow Enforcement partial match

Information flow enforcement can restrict redirects to only approved/trusted destinations, stopping untrusted user-supplied URLs from being followed.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-01 mostly match
prevents

Credential lifecycle management directly includes enforcing session expiration to prevent reuse.

PR.AA-05 mostly match
prevents

Authorization policy enforcement and review covers terminating stale sessions to limit access scope.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require input validation and untrusted-redirect controls that prevent CWE-601.

PR.AA-03 partial match
prevents

Authentication mechanisms can incorporate session timeout checks but do not inherently address expiration policy.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.23 Web filtering partial match
mitigates

Preventing access to attacker-controlled or malicious sites stops users from being redirected to untrusted locations via open-redirect or phishing links.

A.8.5 Secure authentication none match
none

Automatic termination of inactive sessions and limits on connection duration shrink the window during which a hijacked or unattended authenticated session can be exploited.

References