CVE-2025-0255

HCL DevOps Deploy / HCL Launch could allow a remote privileged authenticated attacker to execute arbitrary commands on the system by sending specially crafted input containing special elements.
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.2 HIGH
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
HCLCNA
7.2 HIGH
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 35%
VendorProductVersion
hcltechswhcl_devops_deploy
8.0.0.0 ≤
𝑥
< 8.0.1.5
hcltechswhcl_devops_deploy
8.1.0
hcltechswhcl_launch
7.0.0.0 ≤
𝑥
< 7.0.5.26
hcltechswhcl_launch
7.1.0.0 ≤
𝑥
< 7.1.2.22
hcltechswhcl_launch
7.2.0.0 ≤
𝑥
< 7.2.3.15
hcltechswhcl_launch
7.3.0.0 ≤
𝑥
< 7.3.2.10
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0119060