CVE-2025-52611 affects HCL iControl v4.0.0 and involves an unhandled exception that discloses stack trace information due to accessing an undefined property ('dashboard key') in the application's JavaScript code. This vulnerability is categorized as CWE-209, indicating that error messages reveal sensitive information that could aid an attacker in understanding the internal workings of the application. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and low confidentiality impact with no integrity or availability impact.

The vulnerability allows disclosure of sensitive information through error messages containing stack traces. This information leakage is limited to confidentiality impact and does not affect integrity or availability. The low CVSS score reflects that the vulnerability is unlikely to be exploited for significant damage but could aid attackers in reconnaissance.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround is currently documented. Users of HCL iControl v4.0.0 should monitor HCL advisories for updates addressing this issue. Until a fix is available, consider minimizing exposure of the affected application to untrusted networks to reduce risk.