HCL iControl EUVD-2026-51543

Local access to the host running HCL iControl 4.3.0 or 4.4.0 is required (AV:L). The CVSS vector PR:N confirms no privileges are needed on the local system - any local user account or process can access the exposed files. The vulnerability is present in the default deployment of the affected versions due to improper hardening, meaning no special feature needs to be enabled. Exploitation is limited by the requirement for local host access: remote unauthenticated exploitation across the network is not indicated by the AV:L vector. The confidentiality impact is limited (C:L) and does not include integrity or availability impact.

The CVSS 3.1 base score of 4.0 (Medium) with vector AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N indicates a low-complexity local exposure with no privileges required and limited confidentiality impact. No EPSS score was provided, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation. No POC is known at time of analysis. The real-world risk is constrained by the local attack vector (AV:L): an adversary must already have local access to the affected host to exploit this flaw, significantly narrowing the threat surface. However, the PR:N (no privileges required) metric means any local process or unprivileged user account can trigger the exposure - this matters in multi-tenant or shared hosting environments. The C:L impact is limited, but leaked configuration data can serve as reconnaissance for higher-impact follow-on attacks. Overall, this is a low-urgency but valid finding for environments where HCL iControl hosts are multi-user or shared.

An unprivileged local user or compromised local process on a host running HCL iControl 4.3.0 or 4.4.0 navigates to the improperly protected configuration file paths - either via the local filesystem or a locally bound web server endpoint - and reads internal configuration data such as service credentials, internal network addresses, or application secrets. No POC is publicly known, but the attack requires no special tooling beyond filesystem or HTTP access.