CVE-2025-62340 describes an inadequate session timeout vulnerability in HCL Software iControl. The affected version 4.2.0 fails to properly expire user sessions after inactivity, which could increase the risk of unauthorized session reuse. The CVSS 3.1 base score is 3.1, reflecting a low severity with network attack vector, high attack complexity, low privileges required, no user interaction, and limited confidentiality impact. No known exploits are reported, and no vendor remediation or patch is currently available.

The vulnerability may allow an attacker with access to a valid session token to reuse that session if it remains active beyond the intended timeout period. This could lead to limited confidentiality exposure but does not affect integrity or availability. The overall impact is low given the conditions required and the limited scope of the confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider implementing compensating controls such as manual session invalidation, reducing session timeout settings if configurable, and monitoring for unusual session activity. No official vendor fix or temporary workaround has been documented.