CVE-2025-62305 affects HCL AION 2.1.0 and involves a vulnerability where specific operations may trigger out-of-band interactions, potentially causing sensitive information to be disclosed unintentionally to external systems. This behavior aligns with CWE-201, which concerns the insertion of sensitive information into data sent outside the system. The vulnerability has a CVSS 3.1 base score of 5.1, with attack vector as adjacent network, high attack complexity, low privileges required, and requiring user interaction. The impact includes limited confidentiality, integrity, and availability losses. No official remediation or patch has been published by the vendor, and no exploits are known in the wild.

The vulnerability may allow exposure of sensitive information to external systems under specific conditions, potentially compromising confidentiality. Integrity and availability impacts are also rated as low. The medium CVSS score reflects a moderate risk but does not indicate widespread or critical exploitation currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is provided by HCL, users should monitor vendor communications for updates. Until a patch is available, limit exposure by restricting access to affected versions and applying standard network security controls relevant to adjacent network attack vectors.