Is CVE-2024-23570 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-23570 being exploited in the wild.

How severe is CVE-2024-23570?

Medium severity, with a CVSS score of 4.3, published 17 July 2026.

Which products and versions are affected?

HCL Software Aftermarket EPC 1.0.0.

Is there a fix for CVE-2024-23570?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2024-23570 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2024-23570?

Check whether you run HCL Software Aftermarket EPC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-23570: HCL Aftermarket EPC clickjacking vulnerability

CVE-2024-23570 · Severity: medium · CVSS 4.3 · Published 2026-07-17

HCL Aftermarket EPC, a platform used for managing electronic parts catalogs, is vulnerable to clickjacking. This flaw allows an attacker to trick users into performing unintended actions by overlaying the application's interface on a malicious website. Successful exploitation could lead to unauthorized configuration changes, sensitive information disclosure, or phishing attacks against employees.

Technologies: HCL Software Aftermarket EPC. Vendors: HCL Software.

Quick answers

Is CVE-2024-23570 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-23570 being exploited in the wild.
How severe is CVE-2024-23570?: Medium severity, with a CVSS score of 4.3, published 17 July 2026.
Which products and versions are affected?: HCL Software Aftermarket EPC 1.0.0.
Is there a fix for CVE-2024-23570?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2024-23570 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2024-23570?: Check whether you run HCL Software Aftermarket EPC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A clickjacking (Cross-Frame Scripting) vulnerability exists in HCL Aftermarket EPC version 1.0.0 due to insufficient frame-busting protections or missing security headers like X-Frame-Options or Content-Security-Policy (frame-ancestors). An unauthenticated remote attacker can embed the vulnerable application into an iFrame on a controlled malicious website. By enticing a legitimate user to visit the site and interact with the hidden frame, the attacker can facilitate UI redressing attacks, potentially leading to Cross-Site Request Forgery (CSRF) or the leakage of sensitive session information. The vulnerability is tracked as CVE-2024-23570.

Affected products

HCL Software Aftermarket EPC 1.0.0

Timeline

2026-07-17: disclosed: Initial publication of the CVE record and HCL security bulletin.
2026-07-17: advisory

References

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132294

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.