CVE-2026-56609
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
HCL iControl is affected by weak SSL/TLS version support. The application used outdated protocols TLS 1.0 and 1.1, which lack modern security features and are vulnerable to known attacks, exposing sensitive data during transmission.
Risk Assessment
An attacker can intercept and decrypt network traffic, gaining access to confidential information transmitted between client and server.
Recommendation
Configure HCL iControl to use only TLS 1.2 or later, disabling TLS 1.0 and 1.1.
Other vulnerabilities in HCL iControl
See all- CVE-2026-56608Low
HCL iControl is affected by missing access control. The application failed to enforce proper granular access controls, allowing users to access administrator-level functionalities without appropriate authorization.
- CVE-2026-56571Low
HCL iControl was affected by Improper Error Handling vulnerabilities, involving out of memory, null pointer exceptions, system call failure, database unavailable, network timeout, and hundreds of other common conditions that can cause errors.
- CVE-2026-56570Low
HCL iControl was affected by Auto complete Enabled vulnerabilities, exposing sensitive information such as valid usernames, email addresses used for login, and account identifiers. If accessed from shared environments, attackers may enumerate valid usernames through browser suggestions.
- CVE-2026-56569Medium
HCL iControl is vulnerable to sensitive data exposure. The issue stems from improper web server or application hardening, leading to public access to internal configuration files.
- CVE-2026-56568Low
HCL iControl was affected by Information Exposure Through Verbose Client-Side API Error Messages, displaying raw server/API error messages to users instead of generic ones, exposing internal endpoint names, request parameters, error codes, and authentication status.
- CVE-2026-56567Medium
HCL iControl version 4.3.0 is vulnerable to security misconfiguration. The issue involves public exposure of internal configuration files due to improper web server or application hardening.
- CVE-2025-62347Medium
HCL iControl is vulnerable to improper input validation. A flawed implementation of a security tactic fails to properly verify whether received input matches the expected type, potentially leading to unexpected system behavior and security bypasses.
- CVE-2025-62340Low
The vulnerability in HCL iControl is due to inadequate session timeout. The web application does not automatically terminate user sessions after a period of inactivity.
- CVE-2025-52612High
HCL iControl was affected by Export CSV - CSV Injection vulnerability. It is vulnerable to a reflected cross-site scripting vulnerability. This was caused by an insufficient sanitation of input parameters.
- CVE-2025-52611Low
HCL iControl v4.0.0 discloses a stack trace due to an unhandled exception when JavaScript code attempts to read the 'dashboard key' property from an undefined object, possibly due to a missing or improperly initialized variable.
Original NVD description (English source)
HCL iControl is affected by Weak SSL/TLS Version Supported vulnerability. It was observed that the application was using weak TLS versions such as TLS 1.0 and 1.1. These outdated protocols lack modern security features, making them vulnerable to known attacks and exposing sensitive information during data transmission.