CVE-2025-62306: CWE-221 Information Loss or Omission in HCL Software IEM

HCL IntelliOps Event Management (IEM) version 1.4.0 suffers from an information loss or omission vulnerability (CWE-221) where insufficient logging breaks auditability and observability of workflows. This could impede incident response by limiting the information available to detect or analyze malicious activity after an attacker gains access to the application. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, scope changed, no confidentiality impact, limited integrity impact, and no availability impact.

The vulnerability primarily affects the integrity of audit logs by omitting critical information, which reduces the ability to monitor and respond to security incidents effectively. There is no direct confidentiality or availability impact. However, the reduced observability may allow attackers to operate with less risk of detection once inside the system.

No official patch or remediation guidance is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is provided, organizations should consider additional compensating controls to enhance logging and monitoring around the affected workflows.