HCL Aftermarket Discrete Production Console (DPC) contains a file discovery flaw that enables an attacker to read arbitrary files stored on the system. The vulnerability is classified as a data exposure weakness, allowing a malicious actor to access sensitive files that may contain credentials, configuration data, or other confidential information. Once files are exposed, the adversary may leverage the retrieved data to orchestrate further attacks against the system or its network.

The affected product is HCL Aftermarket DPC, version 1.0.0 as indicated by the corresponding CPE string. Systems running this version are susceptible to the file discovery issue.

The CVSS score of 6.5 reflects a medium severity impact, and the EPSS score is currently unavailable. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation requires an authenticated session or local access to the DPC application; it may also be achievable remotely if the application exposes an interface that accepts file paths as input.