HCL iControl EUVD-2026-51542

The CVSS vector AC:H indicates that exploitation is not trivially achievable against default request patterns - specific request crafting is required to induce error states that return verbose messages. The vulnerability is exploitable over the network without authentication (PR:N) and without user interaction (UI:N), meaning any network-reachable instance of HCL iControl 4.3.0 or 4.4.0 is technically within scope. Exploitation is strictly bounded to those two versions; other versions are not confirmed vulnerable. The limiting factors are: (1) AC:H means the attacker must know or discover which request patterns trigger revealing error responses rather than silent failures; (2) impact is confined to information disclosure - there is no mechanism within this CVE for code execution, data modification, or denial of service; (3) deployments protected behind VPN or firewall rules restricting access to trusted clients significantly reduce attacker reach.

The vendor-assigned CVSS score of 3.7 (Low) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N accurately reflects the narrow real-world impact. The AC:H metric is significant: exploitation is not trivially repeatable against default interactions but requires crafting requests that deliberately induce server-side error states. Impact is strictly limited to partial confidentiality loss (C:L) - no integrity or availability degradation is possible through this vulnerability alone. No EPSS score was provided in the available data, precluding probability-of-exploitation comparison. The vulnerability is not listed in CISA KEV and no POC has been identified at time of analysis. In practice, this is a reconnaissance-enabling finding rather than a direct-compromise vulnerability: the exposed authentication status and endpoint metadata reduce attacker effort in mapping the application surface for subsequent attack chains. Priority should be low for most environments unless HCL iControl is exposed to untrusted networks or handles highly sensitive data where internal API structure disclosure carries elevated risk.

An unauthenticated remote attacker sends intentionally malformed or boundary-condition API requests to HCL iControl 4.3.0 or 4.4.0 to deliberately induce server-side error conditions. The application returns raw error responses disclosing internal endpoint paths, parameter schemas, error codes, and whether the invoking session is authenticated. The attacker aggregates this metadata across multiple crafted requests to construct an accurate map of the application's internal API surface, reducing reconnaissance effort for subsequent targeted exploitation attempts. No public exploit code has been identified at time of analysis.