HCL iControl CVE-2025-62347

The CVSS vector (PR:L) confirms that an authenticated low-privileged account is a prerequisite - unauthenticated exploitation is not indicated by available data. The application must be network-reachable (AV:N), meaning the attack surface is any network path to the HCL iControl service. Exploitation is limited to HCL iControl versions 4.3.0 and 4.4.0; other versions are not confirmed affected. No user interaction beyond the attacker's own session is required (UI:N). No specific non-default configuration is documented as a trigger in the available description, though the 'Authentication Bypass' tag suggests the flaw may be accessible via standard authenticated workflows rather than requiring a special deployment mode. The primary limiting factor is the requirement for an initial authenticated session, which restricts the attacker pool to credentialed users or those who can obtain credentials.

The vendor-assigned CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) scores this as Medium (4.3), indicating a low-complexity, network-reachable flaw requiring only low-privileged authentication. The impact is bounded to limited integrity degradation with no confidentiality or availability loss. However, the vendor tag 'Authentication Bypass' introduces tension with the PR:L metric - if the vulnerability enables bypassing authentication controls, the effective privilege barrier may be lower than PR:L implies; this ambiguity should be verified against the vendor KB0132395 advisory. EPSS data is not provided, limiting probabilistic exploitation forecasting. The vulnerability is not listed in CISA KEV and no publicly available POC exploit code has been identified, so real-world exploitation risk appears low-to-moderate at this time. The limited impact (I:L only) and requirement for an initial authenticated session constrain the blast radius, making this a medium-priority finding unless the 'Authentication Bypass' capability enables privilege escalation in chained attack scenarios.

An authenticated low-privileged user with network access to HCL iControl sends a crafted request containing type-mismatched or malformed input targeting the flawed architectural security tactic. The input validation mechanism fails to reject the non-conforming data, allowing the attacker to bypass security controls enforced at that layer and make unauthorized modifications to system state or data. No public POC has been identified, so exploitation currently requires independently discovering the specific input pattern that triggers the bypass.