Vulnerability · Published Jun 4, 2026 · Assigned by HCL

CVE-2025-52611HCL iControl was affected by Unhandled Exception - Stack Trace Disclosure vulnerability

Low 3.1

In plain English

A low-severity security flaw in iControl from HCL. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).

Severity (CVSS 3.1)3.1Low

Exploit odds (30 days)0.2%top 95.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

HCL iControl v4.0.0 was affected by Unhandled Exception - Stack Trace Disclosure vulnerability. The error occurs due to an undefined property being accessed in the application's JavaScript code. Specifically, the code attempts to read the property dashboard key from an object that is undefined. This issue likely stems from one of the following: A missing or improperly initialized object.

Affected products (as reported)

Vendor	Product	Versions
HCL	iControl	4.0.0

Weakness: CWE-209 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131041