Medium severity · published Jun 4, 2026
CVE-2025-52611
HCL iControl was affected by Unhandled Exception - Stack Trace Disclosure vulnerability
4.3
CVSS
0.2%
EPSS
No
On KEV
Description
HCL iControl v4.0.0 was affected by Unhandled Exception - Stack Trace Disclosure vulnerability. The error occurs due to an undefined property being accessed in the application's JavaScript code. Specifically, the code attempts to read the property dashboard key from an object that is undefined. This issue likely stems from one of the following: A missing or improperly initialized object.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 5% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IC
iControl · HCL
4.0.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-52611
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-52611
Vendor Advisory
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131041
More from iControl
8.8
CVE-2025-52612
HCL iControl was affected by Export CSV - CSV Injection vulnerability.
5.3
CVE-2025-52609
HCL iControl was affected by Missing Security Headers vulnerability.
4.3
CVE-2025-52606
HCL iControl was affected by Weak Input Validation vulnerability. .
4.3
CVE-2025-52608
HCL iControl was affected by Missing Cookie Attributes vulnerability.