HCL iControl EUVD-2025-210062

Exploitation requires a valid low-privilege authenticated session in HCL iControl (PR:L per CVSS vector) - unauthenticated access alone is not sufficient. The application must be reachable over a network connection (AV:N). No user interaction from another party is required (UI:N). The specific application feature, endpoint, or input field subject to the validation failure is not identified in the available data - the vendor KB0131178 article should be consulted for precision. Exploitation is limited by the authentication requirement, which restricts the attacker pool to credentialed internal or external users; the low integrity-only impact (C:N, A:N) further limits the damage potential from a single exploit attempt. Note: the 'Information Disclosure' tag conflicts with the C:N CVSS rating - if confidentiality is actually impacted, the exploitation conditions and risk profile may differ from what the CVSS vector alone suggests.

The overall risk is moderate-to-low in most deployment contexts. The CVSS base score of 4.3 reflects a network-accessible, low-complexity flaw (AV:N/AC:L) requiring authenticated access (PR:L), which meaningfully reduces the attack surface compared to unauthenticated vulnerabilities. The CVSS impact scores show only low integrity impact (I:L) with no confidentiality (C:N) or availability (A:N) impact - however, this conflicts with the 'Information Disclosure' tag assigned to the CVE, which would typically imply a confidentiality impact. This contradiction is unresolved in the available data and should be verified against the vendor's KB0131178 advisory. No EPSS score was provided, no KEV listing exists, and no public exploit code has been identified - all signals pointing toward low exploitation urgency. SSVC assessment suggests 'Track' priority: no public exploitation, requires authentication, and limited technical impact. The primary concern is whether the CWE-209 angle exposes sensitive internal error messages to low-privileged authenticated users, which could facilitate further reconnaissance even if the raw CVSS integrity score appears modest.

An authenticated user with low-privilege credentials connects to HCL iControl over the network and submits a crafted request containing input of an unexpected data type - for example, passing a string where an integer is expected. The application fails to validate or correctly reject the malformed input, triggering error handling that may expose sensitive internal details (consistent with CWE-209) or allow minor data integrity manipulation. No public exploit code is known at the time of analysis, so exploitation would require manual crafting of malformed requests.