CVE-2025-31953 HCL iAutomate is affected by hardcoded credentials
Hardcoded credentials in HCL iAutomate allow unauthorized parties to access confidential data or bypass security controls.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-31953?
CVE-2025-31953 is a high-severity vulnerability in HCL Software iAutomate, published on 24 Jul 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
HCL iAutomate includes hardcoded credentials which may result in potential exposure of confidential data if intercepted or accessed by unauthorized parties.
Weakness: CWE-798
Which versions are affected by CVE-2025-31953?
It affects 1 product.
Products include Hcltech Dryice Iautomate.
How do I fix CVE-2025-31953?
No fix has been published for CVE-2025-31953 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-31953 being exploited?
There is no known exploitation of CVE-2025-31953 in the wild and no public exploit code.
Other vulnerabilities in HCL Software iAutomate
- CVE-2025-31955 HCL iAutomate is affected by a sensitive data exposure vulnerability
- CVE-2025-31952 HCL iAutomate is affected by an insufficient session expiration
- CVE-2023-23347 Use of a broken cryptographic algorithm affects HCL DRYiCE iAutomate
- CVE-2024-42207 HCL iAutomate is affected by a session fixation vulnerability
- CVE-2025-31954 HCL iAutomate is susceptible to a sensitive information disclosure
Sources
Also known as GHSA-v3gf-cfpp-pjjg.