CVE-2025-52608 describes a missing cookie attributes vulnerability in HCL iControl 4.0.0. The application sets cookies without the Secure and SameSite attributes and uses a root path, which can weaken cookie security controls. This is identified as CWE-614, indicating sensitive cookies in HTTPS sessions without the Secure attribute. The CVSS 3.1 base score is 3.1 (low), with network attack vector, high attack complexity, low privileges required, no user interaction, and no confidentiality or availability impact but low integrity impact. No patch or official remediation level is currently documented.

The vulnerability may allow cookies to be transmitted over non-secure channels or be susceptible to cross-site request forgery or other cookie-based attacks due to missing Secure and SameSite attributes. However, the CVSS score and description indicate no direct confidentiality or availability impact, only a low integrity impact. There are no known exploits in the wild, and the risk is considered low.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing compensating controls such as enforcing HTTPS usage and reviewing cookie handling policies. Monitor vendor communications for updates on patches or official mitigations.