Inadequate Session Timeout in HCL iControl Web Application
CVE-2025-62340

3.1LOW

Key Information:

Vendor

HCL Software Software

Status
Icontrol
Vendor
CVE Published:
17 June 2026

What is CVE-2025-62340?

The HCL iControl web application is vulnerable to inadequate session timeout, exposing users to potential unauthorized access after periods of inactivity. This vulnerability arises when the application does not automatically terminate user sessions, allowing potential threats to exploit unmanaged sessions. Organizations using HCL iControl should implement immediate measures to review session management policies and apply necessary updates to mitigate risks.

Affected Version(s)

iControl v4.2.0

References

https://support.hcl-software.com/csm?id=kb_article&syspar...

CVSS V3.1

Score:
3.1
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.