The vulnerability is an unhandled exception that exposes a full stack trace when JavaScript attempts to access an undefined dashboard key property. The stack trace includes file names, line numbers, and function names, which could reveal internal code structure and potential entry points. However, the disclosed information does not provide direct execution privileges or remote code execution. The weakness is classified as CWE‑209, an Information Disclosure vulnerability.

HCL iControl version 4.0.0 is affected. The bug occurs inside the JavaScript runtime of the application, so the impact applies to any deployment of that release. No other versions are listed.

The CVSS score of 3.1 indicates low severity. The EPSS score is not available and the vulnerability is not in the CISA KEV list, which suggests limited widespread exploitation. The likely attack vector is remote via the web interface; by accessing a page that triggers the exception, an attacker could retrieve the stack trace. Because it only reveals information, the risk is low. Nevertheless, mitigating the exposure reduces the surface for reconnaissance.