CVE-2025-62313 identifies a vulnerability in HCL AION 2.1.0 where protections against brute-force authentication attempts are insufficient. This improper restriction of excessive authentication attempts (CWE-307) may enable attackers to repeatedly try to authenticate, increasing the risk of unauthorized access or account compromise. The CVSS 3.1 base score is 5.4, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact. No patch or official remediation level has been provided by HCL, and the product is not a cloud service, so remediation depends on vendor updates.

The vulnerability allows repeated authentication attempts without adequate rate limiting or lockout mechanisms, which could facilitate brute-force attacks. This may lead to unauthorized access or compromise of user accounts under certain conditions. The impact is rated medium severity with low integrity and availability impacts and no confidentiality impact. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation has been published by HCL, users of HCL AION 2.1.0 should monitor vendor communications for updates. In the meantime, consider implementing external protections such as network-level rate limiting or multi-factor authentication to reduce risk.