CVE-2025-52611 describes a vulnerability in HCL iControl v4.0.0 where an unhandled exception causes stack trace information to be disclosed via error messages. The root cause is an attempt to read the 'dashboard key' property from an undefined object in JavaScript code, likely due to missing or improperly initialized objects. This results in error messages that may leak sensitive internal information. The vulnerability is categorized as CWE-209 (Generation of Error Message Containing Sensitive Information). The CVSS 3.1 base score is 3.1, reflecting a low-severity confidentiality impact with network attack vector, high attack complexity, and low privileges required.

The vulnerability may expose sensitive internal information through error messages containing stack traces. This could aid an attacker in understanding the internal workings of the application but does not directly impact integrity or availability. The low CVSS score reflects limited confidentiality impact and no known active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is provided, users should monitor HCL advisories for updates. Until a patch is available, consider restricting access to error message outputs or implementing custom error handling to avoid disclosing stack traces.