The vulnerability arises from verbose client‑side API error messages that display raw server/API error details to users. These messages expose internal endpoint names, request parameters, error codes, and authentication status, corresponding to CWE‑209. The primary impact is the disclosure of internal system information, providing an attacker with reconnaissance material that could facilitate further attacks, though the vulnerability does not directly allow code execution or loss of data integrity.

HCL Software’s HCL iControl is affected. No specific product version is listed in the CNA data, so the vulnerability potentially impacts all deployments of HCL iControl until a patch or configuration change is applied.

The CVSS score of 3.7 indicates low‑to‑moderate severity, and an EPSS score of less than 1% suggests a very low probability of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog, further implying limited real‑world use. Because the error messages are presented to clients, the attack vector is most likely a local or remote web/API request; the attacker would need to trigger the error condition to see the messages, which is inferred from the description as no explicit exploit code is provided.