HCL iControl 4.0.0 suffers from a CWE-209 weakness where error messages generated by the system may contain sensitive information because input is not properly validated for expected types. This weak input validation flaw can lead to the generation of error messages that inadvertently disclose internal details. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity, requiring low privileges and no user interaction, and resulting in limited impact to integrity but no confidentiality or availability impact. There is no vendor-provided patch or remediation level indicated, and no known exploits have been observed.

The vulnerability may lead to limited information disclosure through error messages that reveal sensitive internal details. It does not affect confidentiality, availability, or cause direct integrity loss beyond the limited scope indicated. No active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider minimizing exposure of the affected version and monitor for vendor updates. Avoid disclosing error messages externally or in logs accessible to untrusted parties to reduce information leakage risk.