HCL iControl CVE-2025-52609

HCL iControl must be network-accessible from the attacker's position. The CVSS AC:H rating explicitly signals that exploitation is not straightforward - a separately exploitable XSS injection point within the application must exist in addition to the missing headers; the missing header alone does not create an XSS attack, it removes a browser-side mitigation layer. No authentication is required per PR:N in the CVSS vector. Impact is further limited by modern browser behavior: X-XSS-Protection-style filtering has been removed from Chromium-based browsers (Chrome 78+) and Edge 17+, so for users of current browsers, the practical exploitability depends entirely on whether a Content-Security-Policy is absent rather than the legacy header. Users on Firefox (which never implemented XSS auditor) and modern Chrome/Edge are not protected by legacy header mitigations regardless. No specific configuration mode or non-default deployment setting is described as required.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N yields a score of 3.7 (Low), driven largely upward by the network attack vector but constrained by high complexity (AC:H) and minimal impact (integrity-only, low). The AC:H rating is significant: it signals that exploitation requires conditions outside the attacker's direct control, most likely the existence of a separate injectable XSS vector within the application itself - the missing header is a passive gap, not a standalone exploit primitive. EPSS data was not provided, and the vulnerability is absent from CISA KEV, confirming no confirmed active exploitation. No public POC is known. The UI:N rating in the CVSS vector is atypical for XSS, which conventionally requires user interaction (UI:R); this likely reflects that the scored flaw is the server-side header misconfiguration rather than XSS execution itself - a nuance security teams should factor into prioritization. Overall, real-world risk is low: this is a hardening gap meaningful for compliance posture but unlikely to be opportunistically exploited in isolation.

An unauthenticated remote attacker who identifies or can inject a reflective or stored XSS payload into HCL iControl - a precondition implied by the AC:H rating - could deliver a malicious link or stored script that executes in a victim's browser session because the server does not emit headers instructing the browser to block such execution. In legacy browsers lacking independent XSS filtering, the script would run unimpeded, potentially modifying page content or capturing application context. No public proof-of-concept exists at time of analysis, and exploitation requires both the header gap and a viable injection point to coexist.