HCL iControl EUVD-2025-210058

Exploitation requires victim user interaction: for the reflected XSS, the target must click an attacker-crafted iControl URL containing the unsanitized parameter; for the CSV injection, a user must export the report containing the attacker's formula input and then open it in a spreadsheet application that auto-evaluates formulas (Excel/LibreOffice with formula execution enabled). The affected feature is the Export-CSV report function and any request parameter reflected without encoding in HCL iControl 4.0.0. Limiting factors: the attacker needs no privileges to craft the payload (per PR:N) but cannot succeed without the victim's action (UI:R), CSV impact depends on the victim's spreadsheet settings, and only version 4.0.0 is confirmed affected - reducing realistic risk below the raw 8.8 score.

The signals are mixed and lean toward lower real-world urgency than the 8.8 CVSS suggests. The vendor CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) drives the high score through C:H/I:H/A:H, but full high impact across confidentiality, integrity, and availability is atypical for reflected XSS and CSV injection, whose real impact is usually limited to the victim's session or spreadsheet context - this rating appears inflated and should be verified with the vendor. Corroborating signals point to low priority: EPSS is 0.04% (13th percentile), SSVC records Exploitation: none and Automatable: no (though Technical Impact: total, consistent with the vendor's high-impact rating), there is no CISA KEV listing, and no public exploit. Both flaws require user interaction (UI:R) - a victim must click an attacker-supplied link or open a poisoned CSV - which meaningfully limits mass exploitation. Net: real but low-priority; patch on normal cycles rather than as an emergency.

An attacker sends an administrator a crafted iControl URL whose parameter contains JavaScript; when the admin clicks it, the reflected value executes in their authenticated session and can hijack it. Alternatively, the attacker injects a spreadsheet formula (a value beginning with =) into a field that later appears in an exported report, so when a staff member opens the downloaded CSV the formula runs, potentially invoking commands or exfiltrating cell data. No public proof-of-concept exists, and both paths depend on convincing a victim to click or open the attacker-influenced content.