CVE-2026-35148

HCL DFXServer is affected by a Missing Access Control vulnerability. This vulnerability states that certain endpoints are accessible without any form of authentication in another browser. This allows any network user to invoke these APIs and interact with the application without verification of their identity or authorization level.

CVSS v3 6.3 MEDIUM

6.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131782	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:hcltech:dfx_server:*:*:*:*:*:*:*:*

History

24 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) HCL DFXServer está afectado por una vulnerabilidad de control de acceso faltante. Esta vulnerabilidad establece que ciertos puntos finales son accesibles sin ninguna forma de autenticación en otro navegador. Esto permite a cualquier usuario de la red invocar estas API e interactuar con la aplicación sin verificación de su identidad o nivel de autorización.

Information

Published : 2026-07-16 12:17

Updated : 2026-10-24 21:10

NVD link : CVE-2026-35148

Mitre link : CVE-2026-35148

CVE.ORG link : CVE-2026-35148

JSON object : View

Products Affected

hcltech

dfx_server

CWE

CWE-284

Improper Access Control

{"id": "CVE-2026-35148", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35148", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-16T12:07:14.935323Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@hcl.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "psirt@hcl.com", "affectedData": [{"vendor": "HCL Software", "product": "DFXServer", "versions": [{"status": "affected", "version": "version 2.5 and below"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-16T12:17:35.733", "references": [{"url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131782", "tags": ["Vendor Advisory"], "source": "psirt@hcl.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@hcl.com", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "HCL DFXServer is affected by a Missing Access Control vulnerability. This vulnerability states that certain endpoints are accessible without any form of authentication in another browser. This allows any network user to invoke these APIs and interact with the application without verification of their identity or authorization level."}, {"lang": "es", "value": "HCL DFXServer est\u00e1 afectado por una vulnerabilidad de control de acceso faltante. Esta vulnerabilidad establece que ciertos puntos finales son accesibles sin ninguna forma de autenticaci\u00f3n en otro navegador. Esto permite a cualquier usuario de la red invocar estas API e interactuar con la aplicaci\u00f3n sin verificaci\u00f3n de su identidad o nivel de autorizaci\u00f3n."}], "lastModified": "2026-10-24T21:10:00.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hcltech:dfx_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E55827A6-D50C-408A-B019-1F028F90A778", "versionEndIncluding": "2.5"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@hcl.com"}