HCL iControl CVE-2025-52608

Exploitation requires an authenticated low-privileged session in HCL iControl (PR:L from CVSS vector). The missing Secure attribute is exploitable only when the attacker has a network-layer interception capability between the client and the iControl server (e.g., MitM on the same network segment), and when HTTP - not HTTPS - traffic is possible, reflecting the AC:H complexity rating. The missing SameSite attribute is exploitable only if a victim with an active authenticated session can be induced to visit an attacker-controlled page that issues cross-origin requests to iControl. The root path scope broadens exposure but is not independently exploitable. Exploitation is substantially limited by: requirement for an existing authenticated session, high attack complexity necessitating network position or social engineering, and the low integrity-only impact ceiling. Organizations enforcing HTTPS-only access and modern browser SameSite defaults (Chrome 80+, Firefox) have significantly reduced realistic exposure.

The CVSS 3.1 score of 3.1 (Low) with vector AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N reflects a realistic but constrained threat profile. The high attack complexity (AC:H) indicates that exploitation requires conditions beyond attacker control - such as a man-in-the-middle network position or a specific cross-site scenario with an active authenticated session. PR:L confirms that a low-privileged authenticated session must already exist before exploitation is possible, limiting opportunistic unauthenticated attacks. The integrity-only impact (I:L) with no confidentiality or availability consequences bounds the damage ceiling. No EPSS score is available in the provided data. There is no KEV listing and no public proof-of-concept code, meaning this has not been observed in active exploitation campaigns. In practice, this is a defense-in-depth hygiene issue rather than an acute operational risk; organizations with enforced HTTPS-only access and modern browser policies (automatic SameSite defaults) have substantially reduced real-world exposure.

An authenticated iControl user on a network where an attacker has achieved a man-in-the-middle position (e.g., on a shared corporate Wi-Fi or via ARP spoofing) could have their session cookie intercepted if any HTTP requests are made, due to the missing Secure attribute. Alternatively, an attacker could host a malicious webpage that triggers a cross-site request to iControl from the victim's authenticated browser session, exploiting the missing SameSite attribute to perform a low-impact integrity modification. No public proof-of-concept exists at time of analysis.