CVE-2025-52611: HCL iControl was affected by Unhandled Exception - Stack Trace Disclosure vulnerability
HCL iControl v4.0.0 was affected by Unhandled Exception - Stack Trace Disclosure vulnerability. The error occurs due to an undefined property being accessed in the application's JavaScript code. Specifically, the code attempts to read the property dashboard key from an object that is undefined. This issue likely stems from one of the following: A missing or improperly initialized object.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify the application JavaScript to initialize the object that contains the dashboard key (or ensure it is present) and add defensive checks (e.g., if (obj && obj['dashboard key']) ...) before accessing its properties to prevent unhandled exceptions.
HCL iControl JavaScript code access to dashboard key property / object initialization = ensure the object is initialized and check for null/undefined before reading the dashboard key property - Compensating control
Implement application-level/global exception handling and error-response hardening so that internal stack traces are not returned to end users; log full details internally and return generic error messages to clients.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-52611?
The severity of CVE-2025-52611 is rated as low with a score of 3.1.
How do I fix CVE-2025-52611?
To fix CVE-2025-52611, ensure that you update HCL iControl to the latest version where this vulnerability is addressed.
What type of vulnerability is CVE-2025-52611?
CVE-2025-52611 is an Unhandled Exception - Stack Trace Disclosure vulnerability.
What is affected by CVE-2025-52611?
CVE-2025-52611 affects HCL iControl version 4.0.0.
Is CVE-2025-52611 exploitable remotely?
Yes, CVE-2025-52611 is exploitable remotely due to the nature of the vulnerability.