CVE-2025-55252 is a weak password policy weakness in HCL AION version 2, rated CVSS 3.1 (low) in the NVD record. The application allowed easily guessable passwords. HCL's knowledge base article lists the corrected build, so check it, update, and enforce stronger passwords for existing accounts.
What's affected
The NVD record says HCL AION version 2 is affected. It gives no finer build numbers. The CVSS vector is CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:L, the same shape as the upload issue CVE-2025-55251 from the same article.
The HCL support portal did not return article text when I fetched it, so this guide relies on the NVD record. Read the article itself for the fixed version.
How to check if you're exposed
HCL publishes the affected and fixed builds for AION version 2 in its knowledge base article, and that article is the authority. I could not read its text when preparing this guide, so I will not state a fixed version here.
- Find the build you run. The admin or about page of the product usually shows it, and so does your deployment record.
- Open the HCL article listed under Sources and compare your build with its list of affected and fixed builds.
- If the article lists a fix and you are behind it, you are exposed to the issue described here. If your build is not named, ask HCL support to confirm in writing.
Also look at the accounts. A fix to the policy rule does not change passwords that were already set, so review the users you have today and reset any that look weak or shared.
What to do now
- Confirm which AION 2 builds you run.
- Compare them with the build list in the HCL article and plan the update.
- After updating, force a password reset for accounts created under the old policy, starting with administrators.
- Turn on multi factor sign in if your deployment supports it, or put AION behind single sign on.
- Add AION accounts to your regular access review.
Why it matters
The class is CWE-521, weak password requirements. When a system accepts short or common passwords, guessing attacks become cheap. Policy fixes help new passwords only, which is why the cleanup of old ones matters.
The vector requires local access and high privileges, so this is not a remote takeover on its own. Still, weak passwords on privileged accounts turn small gaps into large ones, so treat the reset as the real remediation.
Quick check
Does the update reset my existing weak passwords?
Not as far as the record says. A stricter rule normally applies to future changes, so reset passwords you suspect are weak yourself.
Sources
Last reviewed: 19 October 2026.
