Hcltech Dryice Iautomate vulnerabilities

6 CVEs affecting Hcltech Dryice Iautomate, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-31954, published 2025-11-05.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2025-31952, published 2025-07-24. High severity, CVSS 7.1. EPSS: 0.4% chance of exploitation in the next 30 days. HCL iAutomate is affected by an insufficient session expiration. This allows tokens to remain valid indefinitely unless manually revoked, increasing the risk of unauthorized access.
CVE-2025-31955, published 2025-07-24. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. HCL iAutomate is affected by a sensitive data exposure vulnerability. This issue may allow unauthorized access to sensitive information within the system.
CVE-2025-31953, published 2025-07-24. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. HCL iAutomate includes hardcoded credentials which may result in potential exposure of confidential data if intercepted or accessed by unauthorized parties.
CVE-2024-42207, published 2025-02-05. Medium severity, CVSS 6.0. EPSS: 0.3% chance of exploitation in the next 30 days. HCL iAutomate is affected by a session fixation vulnerability. An attacker could hijack a victim's session ID from their authenticated session.
CVE-2025-31954, published 2025-11-05. Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days. HCL iAutomate v6.5.1 and v6.5.2 is susceptible to a sensitive information disclosure. An HTTP GET method is used to process a request and includes sensitive information in the query string of that…
CVE-2023-23347, published 2023-08-09. High severity, CVSS 7.1. EPSS: 0.1% chance of exploitation in the next 30 days. HCL DRYiCE iAutomate is affected by the use of a broken cryptographic algorithm. An attacker can potentially compromise the confidentiality and integrity of sensitive information.