CVE-2026-35142

Analyzed Analyzed - Analysis Complete

Internal IP Address Disclosure in HCL DFXAnalytics

Publication date: 2026-07-16

Last updated on: 2026-07-17

Assigner: HCL Software

Description

HCL DFXAnalytics is affected by an Internal IP Address Disclosure vulnerability. The application includes internal IP address details within its generated server responses, which could allow a remote attacker to gather sensitive network topology information and use it to map the internal infrastructure for further targeted attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-16

Last Modified

2026-07-17

Generated

2026-08-05

AI Q&A

2026-07-16

EPSS Evaluated

2026-08-04

NVD

CVE-2026-35142

EUVD

EUVD-2026-44918

Affected Vendors & Products

Vendor	Product	Version / Range
hcltech	dfxanalytics	to 3.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

HCL DFXAnalytics has an Internal IP Address Disclosure vulnerability where the application reveals internal IP address details in server responses. This allows remote attackers to collect sensitive network topology information, which could be used to map internal infrastructure for further attacks.

Detection Guidance

To detect this vulnerability, monitor network traffic for server responses containing internal IP addresses. Use tools like curl to inspect HTTP responses from HCL DFXAnalytics endpoints. Check for patterns like private IP ranges (e.g., 10.x.x.x, 192.168.x.x, 172.16.x.x) in response headers or body content.

Impact Analysis

An attacker could use disclosed internal IP addresses to understand your network layout, identify potential targets, and plan more sophisticated attacks against your systems or data.

Compliance Impact

This vulnerability exposes internal IP addresses, which could lead to unauthorized network mapping and potential data breaches. This may violate GDPR's requirement for protecting personal data and HIPAA's safeguards for sensitive health information by enabling attackers to identify infrastructure weaknesses.

Mitigation Strategies

Review and modify server response configurations in HCL DFXAnalytics to remove internal IP address details. Implement network-level controls to restrict access to sensitive information in server responses.

Hi! I’m here to help you understand CVE-2026-35142. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70