CVE-2025-52612 describes a vulnerability in HCL iControl 4.0.0 where the Export CSV functionality does not properly sanitize input parameters, allowing injection of malicious formula elements into CSV files. This can lead to a reflected cross-site scripting vulnerability when the CSV is opened in spreadsheet software that interprets these formula elements. The vulnerability is classified under CWE-1236 (Improper Neutralization of Formula Elements in a CSV File). The CVSS 3.1 base score is 7.1, indicating high severity, with attack vector network, high attack complexity, low privileges required, and user interaction needed. Confidentiality, integrity, and availability impacts are all rated high. No known exploits in the wild or vendor patches are currently documented.

Successful exploitation could allow an attacker to execute arbitrary code or scripts when a user opens a crafted CSV file exported from HCL iControl 4.0.0. This can lead to compromise of confidentiality, integrity, and availability of the affected system or user environment. The reflected XSS nature requires user interaction to trigger the malicious payload.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should exercise caution when opening CSV files exported from HCL iControl 4.0.0, especially those received from untrusted sources. Applying input validation or sanitization on exported CSV content may reduce risk, but official fixes should be monitored.