CVE-2024-23575: HCL Aftermarket EPC information disclosure via detailed error messages

CVE-2024-23575 · Severity: medium · CVSS 5.3 · Published 2026-07-17

HCL Aftermarket EPC, a platform used for managing electronic parts catalogs, is susceptible to information leakage through its error handling. The application provides overly detailed error messages that reveal internal server processing details to any user on the network. While this does not directly grant access to data, an attacker can use this technical information to map out the system and plan more sophisticated, targeted attacks against the organization.

Technologies: HCL Software Aftermarket EPC. Vendors: HCL Software.

Quick answers

Is CVE-2024-23575 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-23575 being exploited in the wild.
How severe is CVE-2024-23575?
Medium severity, with a CVSS score of 5.3, published 17 July 2026.
Which products and versions are affected?
HCL Software Aftermarket EPC 1.0.0.
Is there a fix for CVE-2024-23575?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2024-23575 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2024-23575?
Check whether you run HCL Software Aftermarket EPC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

HCL Aftermarket EPC version 1.0.0 is vulnerable to CWE-209 (Generation of Error Message Containing Sensitive Information). The application's error handling logic returns verbose technical details about server-side processing directly to the client. This vulnerability is reachable over the network without authentication. An attacker can trigger various error conditions to gather reconnaissance data regarding the underlying infrastructure, software versions, or code logic, which can be leveraged to identify further exploitable vulnerabilities. Users are advised to consult HCL Software advisory KB0132294 for remediation steps.

Affected products

  • HCL Software Aftermarket EPC 1.0.0

Timeline

  • 2026-07-17: disclosed: Initial publication of the CVE record.
  • 2026-07-17: advisory: HCL Software released security bulletin KB0132294.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.