HCL iControl CVE-2026-66249

Exploitation requires three concrete conditions: (1) the victim must have an authenticated iControl session so that a session identifier cookie exists; (2) that cookie must actually be transmitted over an unencrypted HTTP connection (the Missing Secure attribute only matters when traffic traverses HTTP rather than being forced to HTTPS); and (3) the attacker must occupy an on-path/man-in-the-middle network position (shared LAN, rogue Wi-Fi AP, ARP spoofing, or compromised intermediary) to intercept the plaintext traffic. Limiting factors: deployments that enforce HTTPS/HSTS end-to-end are not exploitable, exploitation is passive-capture only (confidentiality, C:L, no integrity or availability impact), and the required on-path position accounts for the AC:H rating.

This is a genuinely low-priority issue, and the signals are consistent in that direction. The CVSS 3.1 base score is 3.1 (LOW) with vector AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N - high attack complexity, low confidentiality impact only, no integrity or availability impact. No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided, so there is no public exploit identified at time of analysis. The AC:H rating reflects that exploitation is not trivial: it requires an attacker to already occupy an on-path/man-in-the-middle position on the network and for the victim's session cookie to actually traverse an unencrypted HTTP connection. One data point to verify with the vendor: the vendor assigned PR:L (privileges required) but a Missing Secure Attribute cookie-interception flaw is typically a passive on-path capture requiring no attacker authentication - PR:N with user interaction (UI:R, victim must use HTTP) models the mechanism more faithfully. This discrepancy does not change the LOW severity tier materially. Overall this is a legitimate hardening/defense-in-depth defect, not an urgent remediation.

An attacker positioned on the same network segment as a victim (e.g., shared Wi-Fi, rogue access point, or a compromised router) passively sniffs traffic while the victim's browser transmits an iControl session cookie over a plaintext HTTP connection because the cookie lacks the Secure attribute. The attacker captures the session identifier and replays it to hijack the authenticated session. No public exploit code was identified, and exploitation depends on the attacker achieving an on-path position and the session actually being carried over HTTP.