The vulnerability is a classic HTTP Response Splitting flaw (CWE‑113). A crafted request could cause the application to split the response header and body, enabling an attacker to inject arbitrary content or execute commands on the server. The impact ranges from data exfiltration through injected payloads to hostile command execution if the application processes the split response incorrectly.

The affected product is HCL Aftermarket DPC (HCL Aftermarket Cloud) version 1.0.0. The single identified version in the CPE list confirms that the 1.0.0 release is vulnerable.

The CVSS score of 3.1 indicates low overall severity, and the vulnerability is not listed in the CISA KEV catalog. The risk is primarily derived from the ability of an external attacker to send a malicious HTTP request to the affected endpoint. Exploitation requires no privileged credentials and can be performed over the public network if the application is exposed. The absence of an EPSS score limits quantitative risk modeling, but the potential for arbitrary command execution makes it advisable to remediate promptly.