PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-52611 HCL CVE debrief

CVE-2025-52611 is a low-severity vulnerability (CVSS Score: 3.1) affecting HCL iControl v4.0.0. The issue arises from an unhandled exception leading to stack trace disclosure. This occurs when the application's JavaScript code attempts to access an undefined property, specifically trying to read the 'dashboard' key from an object that has not been properly initialized or is missing.

Vendor
HCL
Product
iControl
CVSS
LOW 3.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-04
Original CVE updated
2026-07-22
Advisory published
2026-06-04
Advisory updated
2026-07-22

Who should care

Users of HCL iControl v4.0.0 should be aware of this vulnerability and take necessary actions to mitigate the risk.

Technical summary

The vulnerability is caused by an undefined property being accessed in the application's JavaScript code. The code attempts to read the property 'dashboard' key from an object that is undefined. This issue likely stems from a missing or improperly initialized object.

Defensive priority

Low

Recommended defensive actions

  • Apply the vendor's advisory or patch as described in [ref-4](https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131041) to address the vulnerability.

Evidence notes

The CVE record [cve-org] and NVD detail [nvd] provide official information about the vulnerability. The source item [source-item] provides additional context.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-52611 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-52611

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-52611 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-52611

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.