CVE-2026-56570

HCL iControl was affected by Auto complete Enabled vulnerabilities. It involves expose sensitive information such as: Valid usernames, Email addresses used for login, Account identifiers If the system is accessed from shared environments, attackers may enumerate valid usernames through browser suggestions.

CVSS v3 3.7 LOW

3.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132395	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:hcltech:icontrol:4.4.0:*:*:*:*:*:*:*

History

23 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) HCL iControl fue afectado por vulnerabilidades de autocompletado habilitado. Implica la exposición de información sensible como: Nombres de usuario válidos, Direcciones de correo electrónico utilizadas para el inicio de sesión, Identificadores de cuenta. Si se accede al sistema desde entornos compartidos, los atacantes pueden enumerar nombres de usuario válidos a través de las sugerencias del navegador.

Information

Published : 2026-07-31 16:17

Updated : 2026-10-23 23:10

NVD link : CVE-2026-56570

Mitre link : CVE-2026-56570

CVE.ORG link : CVE-2026-56570

JSON object : View

Products Affected

hcltech

icontrol

CWE

CWE-522

Insufficiently Protected Credentials

{"id": "CVE-2026-56570", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-56570", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-31T17:41:56.289505Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@hcl.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "psirt@hcl.com", "affectedData": [{"vendor": "HCL Software", "product": "HCL iControl", "versions": [{"status": "affected", "version": "4.3.0 and 4.4.0"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-31T16:17:07.637", "references": [{"url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132395", "tags": ["Vendor Advisory"], "source": "psirt@hcl.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@hcl.com", "description": [{"lang": "en", "value": "CWE-522"}]}], "descriptions": [{"lang": "en", "value": "HCL iControl was affected by Auto complete Enabled vulnerabilities. It involves expose sensitive information such as: Valid usernames, Email addresses used for login, Account identifiers If the system is accessed from shared environments, attackers may enumerate valid usernames through browser suggestions."}, {"lang": "es", "value": "HCL iControl fue afectado por vulnerabilidades de autocompletado habilitado. Implica la exposici\u00f3n de informaci\u00f3n sensible como: Nombres de usuario v\u00e1lidos, Direcciones de correo electr\u00f3nico utilizadas para el inicio de sesi\u00f3n, Identificadores de cuenta. Si se accede al sistema desde entornos compartidos, los atacantes pueden enumerar nombres de usuario v\u00e1lidos a trav\u00e9s de las sugerencias del navegador."}], "lastModified": "2026-10-23T23:10:00.157", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hcltech:icontrol:4.4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "643D5615-9AE9-442B-8751-EF446C4A4AF9"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@hcl.com"}