HCL iControl EUVD-2026-51546

The attacker must have network access to a HCL iControl 4.3.0 or 4.4.0 instance (AV:N, PR:N - no authentication required). The high attack complexity (AC:H) reflects the requirement to reliably trigger one of the enumerated fault states: out of memory conditions, null pointer exceptions, system call failures, database unavailability, or network timeouts - these are transient or conditionally induced states rather than always-on attack surfaces. Exploitation is limited to information disclosure (C:L); there is no integrity or availability impact. The primary limiting factor beyond AC:H is that the attacker must be able to provoke and observe specific error responses, which may require knowledge of the application's fault-triggering inputs or the ability to interfere with dependent services (e.g., interposing on database or network paths). Non-default or hardened error-handling configurations that suppress verbose output would effectively neutralize this vulnerability.

The CVSS 3.1 base score of 3.7 (Low) is consistent with the constrained impact: AV:N confirms network reachability but AC:H signals that exploitation requires elevated complexity to reliably induce the specific error states, PR:N indicates no authentication is required, and the impact is limited to C:L with no integrity or availability consequence. No KEV listing and no public exploit identified at time of analysis further reduces operational urgency. The high attack complexity is a meaningful limiting factor - an attacker must be able to reliably trigger targeted error conditions (e.g., provoke a database timeout or resource exhaustion) rather than simply sending a crafted payload to a stable endpoint. The primary real-world risk is reconnaissance: disclosed stack traces or configuration fragments can meaningfully assist a more sophisticated follow-on attack. For organizations running 4.3.0 or 4.4.0 in internet-exposed configurations, this represents an elevated reconnaissance risk despite the low CVSS score; internally-facing deployments face substantially lower exposure.

An unauthenticated attacker who can reach the HCL iControl network interface deliberately induces an error condition - for example, by submitting a malformed request that triggers a null pointer exception or by saturating a connection to cause a database timeout - and captures the resulting error response, which may contain stack traces, internal class names, file paths, or database connection metadata useful for mapping the application's internals. No public exploit code has been identified at time of analysis, but the technique requires no specialized tooling beyond standard HTTP clients.