Technical impact
The vulnerability resides in HCL iControl’s handling of exception and error events. When incidents such as out‑of‑memory, null pointer dereference, system call failure, database unavailability, network timeout, or a variety of other normal conditions occur, the application produces detailed error responses that expose internal state, configuration details, or database information. This flaw is categorized as CWE‑209 – Improper Handling of Exceptions, and it can compromise confidentiality by leaking sensitive data to an attacker, but it does not provide a path to code execution or privilege escalation.
Affected Systems
This issue affects HCL Software’s HCL iControl application. Specific impacted versions are not enumerated in the advisory; users should verify against vendor guidance for the affected release series.
Risk and Exploitability
The CVSS score of 3.7 places the vulnerability in the low‑to‑moderate range, and the EPSS score of less than 1 % indicates a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector may involve inducing a fault by sending specially crafted requests or manipulating the application to generate an error condition, after which the resulting error message could expose information. A local user could also inadvertently view detailed error pages, and a remote attacker might trigger conditions via the application’s exposed interfaces. Overall, the threat is manageable but warrants timely remediation.
