CVE-2025-62314 affects HCL Software's AION product, specifically version 2.1.0. The vulnerability arises from improper restriction of excessive authentication attempts (CWE-307) due to lack of sufficient anti-automation controls on certain endpoints. This allows automated or scripted requests to bypass rate limiting or challenge mechanisms, potentially leading to unintended behavior or security impacts. The CVSS 3.1 base score is 5.6, reflecting medium severity with attack vector as adjacent network, high attack complexity, low privileges required, and user interaction needed. No vendor advisory or patch information is currently available.

The vulnerability could allow attackers to perform automated or scripted authentication attempts without adequate rate limiting or challenge mechanisms. This may result in unintended behavior or security impacts such as denial of service or partial compromise under certain conditions. The impact is rated medium with limited confidentiality and integrity impact but high availability impact according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing external rate limiting or challenge-response mechanisms at network or application layers to mitigate automated abuse. Monitor authentication endpoints for unusual activity patterns. No official vendor remediation or temporary fix has been published.