CVE-2025-62347
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
HCL iControl is vulnerable to improper input validation. A flawed implementation of a security tactic fails to properly verify whether received input matches the expected type, potentially leading to unexpected system behavior and security bypasses.
Risk Assessment
The organization risks unexpected system behavior and potential security bypasses, which could enable attacks.
Recommendation
Update HCL iControl to a version with improved input validation or apply additional filtering mechanisms.
Other vulnerabilities in HCL iControl
See all- CVE-2026-56609Medium
HCL iControl is affected by weak SSL/TLS version support. The application used outdated protocols TLS 1.0 and 1.1, which lack modern security features and are vulnerable to known attacks, exposing sensitive data during transmission.
- CVE-2026-56608Low
HCL iControl is affected by missing access control. The application failed to enforce proper granular access controls, allowing users to access administrator-level functionalities without appropriate authorization.
- CVE-2026-56571Low
HCL iControl was affected by Improper Error Handling vulnerabilities, involving out of memory, null pointer exceptions, system call failure, database unavailable, network timeout, and hundreds of other common conditions that can cause errors.
- CVE-2026-56570Low
HCL iControl was affected by Auto complete Enabled vulnerabilities, exposing sensitive information such as valid usernames, email addresses used for login, and account identifiers. If accessed from shared environments, attackers may enumerate valid usernames through browser suggestions.
- CVE-2026-56569Medium
HCL iControl is vulnerable to sensitive data exposure. The issue stems from improper web server or application hardening, leading to public access to internal configuration files.
- CVE-2026-56568Low
HCL iControl was affected by Information Exposure Through Verbose Client-Side API Error Messages, displaying raw server/API error messages to users instead of generic ones, exposing internal endpoint names, request parameters, error codes, and authentication status.
- CVE-2026-56567Medium
HCL iControl version 4.3.0 is vulnerable to security misconfiguration. The issue involves public exposure of internal configuration files due to improper web server or application hardening.
- CVE-2025-62340Low
The vulnerability in HCL iControl is due to inadequate session timeout. The web application does not automatically terminate user sessions after a period of inactivity.
- CVE-2025-52612High
HCL iControl was affected by Export CSV - CSV Injection vulnerability. It is vulnerable to a reflected cross-site scripting vulnerability. This was caused by an insufficient sanitation of input parameters.
- CVE-2025-52611Low
HCL iControl v4.0.0 discloses a stack trace due to an unhandled exception when JavaScript code attempts to read the 'dashboard key' property from an undefined object, possibly due to a missing or improperly initialized variable.
Original NVD description (English source)
HCL iControl was affected by Improper Input Validation vulnerability. It is vulnerable to unexpected system behavior and potential security bypasses. This was caused by an implementation flaw in an architectural security tactic that fails to properly validate whether the received input matches the expected type.