CVE-2026-66253
LowCVSS 3.1Summary
iControl is affected by a Session Timeout vulnerability, which could allow an attacker to exploit an unattended or abandoned active session, enabling unauthorized access to the application and the ability to perform actions on behalf of the victim.
Risk Assessment
Lack of proper session timeout increases the risk of session hijacking by unauthorized users, which could lead to data confidentiality breaches and unauthorized actions. The organization may suffer losses due to compromised user accounts.
Recommendation
Configure short session timeouts in the iControl application and automatic logout after inactivity periods. Additionally, implement mechanisms to detect abandoned sessions and invalidate them.
Other vulnerabilities in iControl
See all- CVE-2026-66249Low
iControl is affected by a Missing Secure Attribute vulnerability, which could allow an attacker to intercept cookies transmitted over unencrypted HTTP connections, enabling the unauthorized extraction of sensitive information such as session identifiers.
- CVE-2026-66248Low
iControl is affected by an Improper Error Handling vulnerability, which could allow an unauthenticated attacker to trigger verbose database and system errors, enabling the disclosure of sensitive internal infrastructure details used to plan advanced targeted attacks.
- CVE-2026-66247Medium
iControl is affected by an insecure CORS policy, allowing a malicious website to execute cross-origin requests with credentials. An attacker could access and exfiltrate sensitive data within the victim's active session.
- CVE-2026-66246High
iControl is affected by a Broken Access Control vulnerability that allows an attacker to exploit missing authentication checks or insecure direct object references (IDOR). This enables privilege escalation and unauthorized modification or deletion of sensitive application data.
Original NVD description (English source)
iControl is affected by a Session Timeout vulnerability, which could allow an attacker to exploit an unattended or abandoned active session, enabling unauthorized access to the application and the ability to perform actions on behalf of the victim.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS