CVE-2025-62309 affects HCL AION 2.1.0 by enabling auto-complete on certain input fields, which may cause sensitive data to be stored locally in the browser. This behavior can result in sensitive information being exposed unintentionally if an attacker gains access to the browser's stored data. The vulnerability is categorized as CWE-201 (Insertion of Sensitive Information Into Sent Data). The CVSS 3.1 base score is 2.6, reflecting low severity due to the attack vector being adjacent network, high attack complexity, low privileges required, and user interaction needed. No official remediation or patch is currently documented.

The impact is limited to potential unintended exposure of sensitive information stored by the browser's auto-complete feature. There is no indication of confidentiality, integrity, or availability compromise beyond this local exposure. No known exploits exist in the wild, and the vulnerability requires user interaction and specific conditions to be exploitable.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users and administrators should consider disabling auto-complete functionality in browsers for sensitive input fields within HCL AION 2.1.0 as a precautionary measure. Monitor vendor communications for updates on patches or official mitigations.