The vulnerability in HCL Aftermarket DPC arises from hardcoded sensitive data, a CWE‑798 weakness that allows an attacker to gain direct access to source code or to read embedded credentials if the code is stored in an insecure repository. This results in a serious compromise of confidentiality, potentially revealing privileged information that the application uses or processes.

The affected product is HCL Aftermarket DPC. The CPE indicates version 1.0.0 of the Aftermarket Cloud application, but no broader affected version range is specified by the vendor. Therefore, all installations of HCL Aftermarket DPC that include hardcoded secrets in the code base are potentially vulnerable.

The CVSS score of 7.3 places this vulnerability in the high severity range, highlighting a significant risk to confidentiality. Although EPSS data is not available and the flaw is not listed in CISA’s KEV catalog, the vulnerability is straightforward to exploit once an attacker can read the application’s files or access its repository. The likely attack vector is through direct file access or through a compromised or misconfigured source code repository, and once the secrets are exposed, an attacker can use them for further malicious activity.