The vulnerability involves an autocomplete-enabled flaw in HCL iControl that causes the browser to reveal sensitive information such as valid usernames, email addresses used for logon, and account identifiers. This weakness can allow an attacker to learn credential-related data that were intended to be private, constituting an information‑disclosure weakness (CWE‑522).

Products affected are the HCL iControl web interface from HCL Software. No specific product versions are listed in the data, so all releases of HCL iControl remain potentially vulnerable until a vendor‑supplied fix is applied.

The CVSS base score is 3.7, indicating a low severity impact. The EPSS score is less than 1 %, suggesting that exploitation across the wild is unlikely. It is not identified in the CISA KEV catalog. The attack vector is inferred to be a local or shared‑environment attack; if an attacker can view the browser’s autocomplete suggestions, they can enumerate valid usernames. No explicit prerequisites are documented, but the vulnerability relies on the browser’s ability to present stored login data to the user.