The vulnerability arises from an improper input validation flaw in HCL iControl, where received inputs are not verified against the expected data type. Such oversight can lead to unexpected system behavior and may enable attackers to bypass normal security controls, as indicated by CWE‑20.

Affected systems are installations of HCL iControl. No specific versions are listed, so all releases of the product should be considered potentially impacted until further information is provided.

The CVSS score of 4.3 places the vulnerability in the moderate range, yet the EPSS score of less than 1% and its absence from the CISA KEV catalog suggest a low probability of active exploitation. The attack vector is not explicitly disclosed; however, improper input validation typically offers a remote exploitation pathway through network services or local user input, warranting vigilant monitoring and mitigation.