CVE-2025-52608 describes a Missing Cookie Attributes vulnerability in HCL iControl 4.0.0. The application fails to set critical cookie attributes such as 'Secure' and 'SameSite' on cookies used in HTTPS sessions, and the cookie path is set to the root directory. This can potentially allow cookies to be sent over non-secure channels or be susceptible to cross-site request forgery (CSRF) or other cookie-based attacks. The vulnerability is categorized as CWE-614. No official remediation or patch information is provided in the available data.

The absence of the 'Secure' attribute means cookies may be transmitted over unencrypted HTTP connections, increasing the risk of interception. Missing 'SameSite' attributes can allow cross-site request forgery attacks. However, the CVSS score of 3.1 indicates a low severity impact, with no confidentiality loss, limited integrity impact, and no availability impact reported. There are no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing compensating controls such as enforcing HTTPS strictly and reviewing cookie handling policies. Monitor HCL's advisories for updates regarding patches or official mitigations.