CVE-2026-56569

HCL iControl is affected by weak SSL/TLS version support. The application used outdated protocols TLS 1.0 and 1.1, which lack modern security features and are vulnerable to known attacks, exposing sensitive data during transmission.

HCL iControl is affected by missing access control. The application failed to enforce proper granular access controls, allowing users to access administrator-level functionalities without appropriate authorization.

HCL iControl was affected by Improper Error Handling vulnerabilities, involving out of memory, null pointer exceptions, system call failure, database unavailable, network timeout, and hundreds of other common conditions that can cause errors.

HCL iControl was affected by Auto complete Enabled vulnerabilities, exposing sensitive information such as valid usernames, email addresses used for login, and account identifiers. If accessed from shared environments, attackers may enumerate valid usernames through browser suggestions.

HCL iControl was affected by Information Exposure Through Verbose Client-Side API Error Messages, displaying raw server/API error messages to users instead of generic ones, exposing internal endpoint names, request parameters, error codes, and authentication status.

HCL iControl version 4.3.0 is vulnerable to security misconfiguration. The issue involves public exposure of internal configuration files due to improper web server or application hardening.

HCL iControl is vulnerable to improper input validation. A flawed implementation of a security tactic fails to properly verify whether received input matches the expected type, potentially leading to unexpected system behavior and security bypasses.

The vulnerability in HCL iControl is due to inadequate session timeout. The web application does not automatically terminate user sessions after a period of inactivity.

HCL iControl was affected by Export CSV - CSV Injection vulnerability. It is vulnerable to a reflected cross-site scripting vulnerability. This was caused by an insufficient sanitation of input parameters.

HCL iControl v4.0.0 discloses a stack trace due to an unhandled exception when JavaScript code attempts to read the 'dashboard key' property from an undefined object, possibly due to a missing or improperly initialized variable.