HCL Software iControl version 4.5.0 contains an improper error handling vulnerability (CWE-209) that causes the generation of error messages containing sensitive information. An unauthenticated attacker can exploit this flaw to trigger verbose database and system errors, potentially revealing internal infrastructure details that could aid in planning advanced targeted attacks. The CVSS 3.1 base score is 3.1, reflecting a low severity with network attack vector, high attack complexity, low privileges required, no user interaction, and limited confidentiality impact.

The vulnerability may lead to the disclosure of sensitive internal infrastructure information through verbose error messages. This information disclosure could assist attackers in reconnaissance and planning of further attacks. However, the impact is limited to information disclosure with no direct integrity or availability impact reported.

No patch or official fix is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider restricting access to the affected system and monitoring for unusual error message exposure. Avoid exposing detailed error messages to unauthenticated users where possible.