Read the docs
TI-2020-03566 Aliases CVE-2020-4092GHSA-fc6g-9746-9j7g

Cleartext transmission of sensitive information in "HCL Nomad"

Priority LOW 24CWE-319Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-319.

Summary

"If port encryption is not enabled on the Domino Server, HCL Nomad on Android and iOS Platforms will communicate in clear text and does not currently have a user interface option to change the setting to request an encrypted communication channel with the Domino server. This can potentially expose sensitive information including but not limited to server names, user IDs and document content."

Why it matters now

EPSS 0.0033 26th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—"HCL Nomad""Android versions 1.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, and iOS versions 1.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8"—No fix listedCNA
  • "HCL Nomad" Vendor— Affected "Android versions 1.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, and iOS versions 1.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.0.8" Fixed in — No fix listed CNA

CPE configurations NVD · 15

CPEVersionsRoleVendor
cpe:2.3:a:hcltech:hcl_nomad:1.0:*:*:*:*:android:*:*1.0VulnerableHCL Software
cpe:2.3:a:hcltech:hcl_nomad:1.0:*:*:*:*:iphone_os:*:*1.0VulnerableHCL Software
cpe:2.3:a:hcltech:hcl_nomad:1.0.1:*:*:*:*:android:*:*1.0.1VulnerableHCL Software
cpe:2.3:a:hcltech:hcl_nomad:1.0.1:*:*:*:*:iphone_os:*:*1.0.1VulnerableHCL Software
cpe:2.3:a:hcltech:hcl_nomad:1.0.2:*:*:*:*:android:*:*1.0.2VulnerableHCL Software
cpe:2.3:a:hcltech:hcl_nomad:1.0.2:*:*:*:*:iphone_os:*:*1.0.2VulnerableHCL Software
cpe:2.3:a:hcltech:hcl_nomad:1.0.3:*:*:*:*:android:*:*1.0.3VulnerableHCL Software
cpe:2.3:a:hcltech:hcl_nomad:1.0.3:*:*:*:*:iphone_os:*:*1.0.3VulnerableHCL Software
cpe:2.3:a:hcltech:hcl_nomad:1.0.4:*:*:*:*:android:*:*1.0.4VulnerableHCL Software
cpe:2.3:a:hcltech:hcl_nomad:1.0.4:*:*:*:*:iphone_os:*:*1.0.4VulnerableHCL Software
  • cpe:2.3:a:hcltech:hcl_nomad:1.0:*:*:*:*:android:*:* Versions 1.0 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:hcl_nomad:1.0:*:*:*:*:iphone_os:*:* Versions 1.0 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:hcl_nomad:1.0.1:*:*:*:*:android:*:* Versions 1.0.1 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:hcl_nomad:1.0.1:*:*:*:*:iphone_os:*:* Versions 1.0.1 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:hcl_nomad:1.0.2:*:*:*:*:android:*:* Versions 1.0.2 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:hcl_nomad:1.0.2:*:*:*:*:iphone_os:*:* Versions 1.0.2 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:hcl_nomad:1.0.3:*:*:*:*:android:*:* Versions 1.0.3 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:hcl_nomad:1.0.3:*:*:*:*:iphone_os:*:* Versions 1.0.3 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:hcl_nomad:1.0.4:*:*:*:*:android:*:* Versions 1.0.4 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:hcl_nomad:1.0.4:*:*:*:*:iphone_os:*:* Versions 1.0.4 Vulnerable ·HCL Software
Show 5 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:hcltech:hcl_nomad:1.0.5:*:*:*:*:android:*:*1.0.5VulnerableHCL Software
cpe:2.3:a:hcltech:hcl_nomad:1.0.5:*:*:*:*:iphone_os:*:*1.0.5VulnerableHCL Software
cpe:2.3:a:hcltech:hcl_nomad:1.0.6:*:*:*:*:iphone_os:*:*1.0.6VulnerableHCL Software
cpe:2.3:a:hcltech:hcl_nomad:1.0.7:*:*:*:*:iphone_os:*:*1.0.7VulnerableHCL Software
cpe:2.3:a:hcltech:hcl_nomad:1.0.8:*:*:*:*:iphone_os:*:*1.0.8VulnerableHCL Software
  • cpe:2.3:a:hcltech:hcl_nomad:1.0.5:*:*:*:*:android:*:* Versions 1.0.5 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:hcl_nomad:1.0.5:*:*:*:*:iphone_os:*:* Versions 1.0.5 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:hcl_nomad:1.0.6:*:*:*:*:iphone_os:*:* Versions 1.0.6 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:hcl_nomad:1.0.7:*:*:*:*:iphone_os:*:* Versions 1.0.7 Vulnerable ·HCL Software
  • cpe:2.3:a:hcltech:hcl_nomad:1.0.8:*:*:*:*:iphone_os:*:* Versions 1.0.8 Vulnerable ·HCL Software

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-4092
  2. 2026-10-03 Alias added: GHSA-fc6g-9746-9j7g

References

Advisory 1

  • TI-2024-15613 An insufficient session timeout vulnerability affects HCL Nomad server on Domino CVSS 3.1HIGH 7.5
  • TI-2023-09197 HCL Nomad for web is affected by cryptographic validation of local data access that can be circumvented CVSS 3.1HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences