EUVD-2025-210572
GHSA-jc5q-2735-cxqp
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Network-reachable with low complexity; PR:L because an initial authenticated session is required; scope unchanged with only limited integrity impact from security control bypass.
Primary rating from Vendor (HCL).
CVSS VectorVendor: HCL
Lifecycle Timeline
1DescriptionCVE.org
HCL iControl was affected by Improper Input Validation vulnerability. It is vulnerable to unexpected system behavior and potential security bypasses. This was caused by an implementation flaw in an architectural security tactic that fails to properly validate whether the received input matches the expected type.
AnalysisAI
HCL iControl versions 4.3.0 and 4.4.0 expose a network-accessible integrity bypass to authenticated low-privileged attackers through a broken input validation mechanism. The implementation flaw in an architectural security tactic fails to enforce type conformance on received input, enabling an attacker to manipulate application logic and circumvent security controls. No public exploit has been identified at time of analysis and this vulnerability is not listed in CISA KEV, though the vendor-assigned 'Authentication Bypass' tag elevates operational concern beyond what the CVSS score alone suggests.
Technical ContextAI
HCL iControl is an enterprise control-plane software product from HCL Software. The vulnerability is rooted in CWE-20 (Improper Input Validation), a class of flaws where software accepts input without verifying it conforms to the expected type, format, or semantic range. The description specifies the flaw lies within an 'architectural security tactic' - a structural defense mechanism designed to enforce access control or input integrity at an architectural level - which fails to validate type conformance of received data. This allows the attacker to supply input that bypasses the intended security enforcement logic. CPE cpe:2.3:a:hcl:hcl_icontrol:*:*:*:*:*:*:*:* covers all platform variants of the product, with EUVD-2025-210572 narrowing affected versions to 4.3.0 and 4.4.0.
RemediationAI
Organizations should consult the HCL vendor advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132395 (KB0132395) for patch guidance. No specific patched version number is independently confirmed from the available intelligence data; apply the update recommended in the vendor advisory upon validation. As compensating controls until patching is completed, restrict network access to HCL iControl to trusted IP ranges and enforce the principle of least privilege by auditing and minimizing the number of low-privileged accounts with access to the application. Additionally, increase logging and alerting on anomalous input patterns or unexpected security bypass events within the application. Note that these controls reduce exposure but do not eliminate the underlying vulnerability.
A Boolean-based SQL injection vulnerability exists in HCL Unica that allows remote attackers to manipulate backend datab
Command injection in HCL BigFix RunBookAI 11.2 allows authenticated remote attackers to execute arbitrary operating syst
HCL BigFix Service Management (SX) is affected by a Broken Access Control vulnerability leading to privilege escalation.
SQL injection in HCL Aftermarket DPC version 1.0.0 enables unauthenticated remote attackers to extract sensitive databas
Content Security Policy weakness in HCL Hive Telco Observability's Keycloak authentication component allows remote attac
Missing functional level access control in HCL Aftermarket DPC version 1.0.0 enables privilege escalation attacks that c
Hardcoded credentials in HCL Aftermarket DPC version 1.0.0 enable authenticated low-privilege attackers with user intera
HCL Aftermarket DPC version 1.0.0 is vulnerable to unauthenticated file discovery that allows remote attackers to read s
HCL Aftermarket DPC versions up to 1.0.0 are vulnerable to session fixation attacks that enable attackers to hijack user
HCL AION contains inadequate auditing and logging mechanisms that fail to properly track certain user actions, reducing
HCL Aftermarket DPC versions prior to and including 1.0.0 suffer from an unrestricted file upload vulnerability (CWE-434
HCL AION contains a container base image authentication vulnerability where container images are not properly verified b
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today