HCL iControl CVE-2025-52611

Exploitation requires an authenticated session in HCL iControl v4.0.0 (PR:L in CVSS vector confirms authentication is mandatory - unauthenticated exploitation is not supported by available data). High attack complexity (AC:H) indicates the triggering condition is not reliably reproducible on demand and likely depends on specific application state, session context, or request parameters related to the dashboard feature being in an uninitialized state. Exploitation is limited to confidentiality impact only - no write access or service disruption is possible through this vector. Non-default or misconfigured deployments are not specifically required; the flaw appears to be in the core dashboard code path of the standard v4.0.0 release.

The CVSS 3.1 base score of 3.1 (Low) accurately reflects the constrained real-world risk. The vector AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N indicates network reachability but requires authenticated access (PR:L) and high attack complexity (AC:H), meaning the triggering condition is not trivially reproducible against arbitrary authenticated sessions. Confidentiality impact is limited (C:L) - no data exfiltration, no code execution, no availability impact. No EPSS score was provided in source data, preventing exploitation probability comparison. The vulnerability is not listed in CISA KEV, and no public proof-of-concept has been identified. This is a low-priority finding in isolation; its primary risk is as an enabler for chained attacks by providing reconnaissance data (internal paths, framework versions) to an already-authenticated adversary. Organizations with strict information disclosure postures (PCI-DSS, HIPAA environments) may treat this with higher urgency than the raw score implies.

An authenticated user navigates to or programmatically requests a dashboard-related endpoint or UI component in HCL iControl v4.0.0, triggering the code path that reads the 'dashboard' key from an uninitialized object. The application throws an unhandled JavaScript exception, and the server returns a response containing the full stack trace revealing internal file paths, module names, or framework version strings. The attacker records this information and uses it to identify exploitable libraries or refine subsequent attack payloads against the same environment. No public POC exists at time of analysis.