HCL iControl 4.0.0 is affected by CVE-2025-52612, a CSV Injection vulnerability categorized under CWE-1236. The issue stems from insufficient sanitization of input parameters when exporting CSV files, allowing malicious formula elements to be injected. This can lead to reflected cross-site scripting effects when the CSV is opened in spreadsheet software that processes formulas. The vulnerability has a CVSS 3.1 base score of 7.1, with network attack vector, high attack complexity, low privileges required, user interaction needed, and high impact on confidentiality, integrity, and availability. No vendor-provided patch or official remediation level is currently documented.

Successful exploitation could allow an attacker to inject malicious formulas into CSV files exported by HCL iControl, potentially leading to execution of arbitrary commands or scripts when the CSV is opened in vulnerable spreadsheet applications. This impacts confidentiality, integrity, and availability of data handled by the affected product. The vulnerability requires user interaction and has high attack complexity, reducing but not eliminating the risk. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when opening CSV files exported from HCL iControl 4.0.0, especially those received from untrusted sources. Applying input validation or sanitization at the application level, if feasible, may reduce risk. Monitor vendor channels for updates and patches.