CVE-2025-52609 describes a vulnerability in HCL iControl 4.0.0 where missing security headers allow cross-site scripting (XSS) attacks. This occurs because the absence of these headers disables or bypasses the browser's built-in XSS filtering mechanisms, potentially allowing malicious scripts to execute. The vulnerability is categorized as a protection mechanism failure (CWE-693). The CVSS 3.1 base score is 3.7, reflecting a low impact with network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and no availability impact.

The vulnerability allows an attacker to bypass browser XSS filtering protections due to missing security headers, which can lead to limited integrity impact through cross-site scripting attacks. There is no impact on confidentiality or availability. The overall severity is low, and no active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor HCL's advisories for updates. In the meantime, consider implementing additional security headers manually if possible and applying web application firewall (WAF) rules to detect and block XSS attempts.