The vulnerability arises because the application omits critical cookie attributes, notably Secure and SameSite, and sets the cookie path to the root. This enables an attacker to capture session identifiers over unencrypted connections or forge requests from cross‑site contexts, potentially allowing session takeover or unauthorized actions within the application.

The issue affects HCL iControl. No specific version information is disclosed in the data provided.

With a CVSS score of 3.1, the severity is considered low, and the EPSS score is not available, indicating a relatively low immediate exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through standard web traffic where the missing Secure flag permits sniffing, and the missing SameSite flag permits cross‑site request forgery. Exploitation would require only access to the application’s domain or network traffic, making it an opportunistic risk rather than a highly orchestrated exploit.