CVE-2025-59866
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk0th percentile - higher than 0% of all known CVEs
Summary
The HCL DFMPro, DFXAnalytics and DFXServer installers are affected by an insecure file permissions vulnerability that allows any logged-in non-administrative user to overwrite or replace the executable file with a malicious binary.
Risk Assessment
The risk involves privilege escalation by a local user, potentially leading to system compromise or malware installation.
Recommendation
It is recommended to immediately update HCL DFMPro, DFXAnalytics and DFXServer to the latest version and review and correct file permissions on installation files.
Original NVD description (English source)
The HCL DFMPro, DFXAnalytics and DFXServer installers are affected by ‘Insecure file permissions Leading to Privilege Escalation’ vulnerability, which enables any logged-in non-administrative user to overwrite or replace the executable file with a malicious binary.