A high-severity vulnerability in HCL iAutomate involving hardcoded credentials exposes the system to unauthorized data access by authenticated users.

The application utilizes hardcoded credentials, which constitutes a CWE-798 Use of Hard-coded Credentials flaw. This vulnerability is accessible to an authenticated user with low privileges, as indicated by the CVSS vector PR:L.

The presence of hardcoded credentials creates a significant risk of unauthorized access to sensitive internal data managed by the iAutomate platform. With a CVSS score of 7.1, this vulnerability is classified as High, reflecting the potential for severe data confidentiality breaches and the relative ease of exploitation for an attacker who has already gained low-level access to the environment.

Immediate Action: Review the official HCL support advisory (KB0122646) to identify and apply the necessary security updates or configuration changes provided by the vendor.

Proactive Monitoring: Audit system access logs for unusual account activity or unauthorized authentication attempts originating from internal service accounts or unexpected users.

Compensating Controls: Implement strict network segmentation and egress filtering to isolate the iAutomate instance, limiting the ability of an attacker to move laterally or exfiltrate sensitive data if the credentials are compromised.

Public Exploit Available: Unknown

Given the High severity of this credential-based vulnerability, immediate remediation is required to prevent unauthorized data exposure. Administrators should verify their current version against the HCL support portal and prioritize the deployment of vendor-supplied patches or configuration mitigations to eliminate the hardcoded credentials.