CVE-2025-62340

HCL iControl was affected by Inadequate Session Timeout vulnerability. The vulnerability involves a security risk where a web application fails to automatically terminate user sessions after a period of inactivity

CVSS v3 3.1 LOW

3.1^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.6 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131511	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:hcltech:icontrol:4.2.0:*:*:*:*:*:*:*

History

30 Sep 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) HCL iControl fue afectado por la vulnerabilidad de tiempo de espera de sesión inadecuado. La vulnerabilidad implica un riesgo de seguridad donde una aplicación web no logra terminar automáticamente las sesiones de usuario después de un período de inactividad.

Information

Published : 2026-06-17 13:19

Updated : 2026-10-06 22:10

NVD link : CVE-2025-62340

Mitre link : CVE-2025-62340

CVE.ORG link : CVE-2025-62340

JSON object : View

Products Affected

hcltech

icontrol

CWE

CWE-613

Insufficient Session Expiration

{"id": "CVE-2025-62340", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-62340", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-17T15:03:49.449083Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@hcl.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.6}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "psirt@hcl.com", "affectedData": [{"vendor": "HCL Software", "product": "iControl", "versions": [{"status": "affected", "version": "v4.2.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-17T13:19:15.840", "references": [{"url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131511", "tags": ["Vendor Advisory"], "source": "psirt@hcl.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@hcl.com", "description": [{"lang": "en", "value": "CWE-613"}]}], "descriptions": [{"lang": "en", "value": "HCL iControl was affected by Inadequate Session Timeout vulnerability. The vulnerability involves a security risk where a web application fails to automatically terminate user sessions after a period of inactivity"}, {"lang": "es", "value": "HCL iControl fue afectado por la vulnerabilidad de tiempo de espera de sesi\u00f3n inadecuado. La vulnerabilidad implica un riesgo de seguridad donde una aplicaci\u00f3n web no logra terminar autom\u00e1ticamente las sesiones de usuario despu\u00e9s de un per\u00edodo de inactividad."}], "lastModified": "2026-10-06T22:10:00.247", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hcltech:icontrol:4.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "01440CF2-2739-41E2-8E14-03453ECDED9D"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@hcl.com"}