EUVD-2026-51543
GHSA-ff9w-cjcp-fjhm
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Local access required per description; no privileges needed; limited read-only confidentiality impact with no integrity or availability effect.
Primary rating from Vendor (HCL).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
HCL iControl was affected by Sensitive Data Exposure vulnerabilities. It involves the public exposure of internal configuration files due to improper web server or application hardening.
AnalysisAI
HCL iControl versions 4.3.0 and 4.4.0 expose internal configuration files to local access due to improper web server or application hardening, classified under CWE-497 (Exposure of Sensitive System Information). Local actors without any privileges can read configuration data that should be restricted, potentially revealing sensitive system details usable for follow-on attacks. No public exploit or active exploitation has been identified at time of analysis, and the CVSS score of 4.0 (Medium) reflects the limited local attack surface.
Technical ContextAI
CWE-497 describes a weakness where an application exposes sensitive system or configuration data to parties outside the intended control sphere. In this case, HCL iControl - a network management and control application by HCL Software (CPE: cpe:2.3:a:hcl_software:hcl_icontrol:*:*:*:*:*:*:*:*) - fails to properly harden its web server or application layer, leaving internal configuration files accessible via the local system. This could manifest as world-readable file permissions, a local HTTP service binding configuration files without access controls, or missing directory traversal restrictions. The CVSS AV:L (local) vector indicates exposure is confined to the local host rather than the network, consistent with a misconfigured local application server or filesystem permissions.
RemediationAI
Consult the HCL Software vendor advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132395 for official patch guidance. Patch availability is confirmed per vendor advisory, but an exact fixed version number is not independently confirmed from the provided data - verify the specific remediated release directly via the KB article. As compensating controls pending patch application: restrict filesystem permissions on HCL iControl configuration directories to the application service account only (removing world-read and group-read where unnecessary); if a local HTTP service exposes these files, configure appropriate access controls or disable directory listing; and audit local user accounts on iControl hosts to minimize the number of principals with local access.
More in Hcl Icontrol
View allHCL iControl v3.2.0 exposes sensitive data in transit by advertising support for deprecated TLS 1.0 and TLS 1.1 protocol
Verbose API error responses in HCL iControl 4.3.0 and 4.4.0 leak internal endpoint names, request parameters, error code
HCL iControl versions 4.3.0 and 4.4.0 expose authentication-related sensitive data through browser autocomplete function
Improper error handling in HCL iControl 4.3.0 and 4.4.0 exposes sensitive information through verbose error messages tri
Missing granular access control in HCL iControl v3.2.0 exposes administrator-level functionality to unauthorized users o
HCL iControl versions 4.3.0 and 4.4.0 expose a network-accessible integrity bypass to authenticated low-privileged attac
HCL iControl versions 4.3.0 and 4.4.0 publicly expose internal configuration files due to inadequate web server or appli
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today