HCL iControl was affected by Improper Input Validation vulnerability.

published 2026-07-31 3 mo ago modified 2026-09-29 40 d ago also EUVD-2025-210572

cvss: 4.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 23%
public exploits: 0; none known

HCL iControl was affected by Improper Input Validation vulnerability. It is vulnerable to unexpected system behavior and potential security bypasses. This was caused by an implementation flaw in an architectural security tactic that fails to properly validate whether the received input matches the expected type.

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 3 mo ago (2026-07-31)

Exploit prediction

0.31% chance of exploitation in the next 30 days, higher than 23% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Affected products

HCL HCL iControl

Classification

Weakness

CWE-20 Improper Input Validation

References

support.hcl-software.com /csm?id=kb_article&sysparm_article=KB0132395

Sources

CVE List CVE-2025-62347
NVD CVE-2025-62347

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary