The vulnerability is an Admin Session Concurrency flaw that lets an attacker exploit overlapping user sessions to hijack or impersonate an administrative user. Classified as CWE‑557, it reveals insecure handling of session identifiers. If exploited, the attacker gains administrative privileges, allowing full read, modify, or delete capabilities over system data, configurations, or settings. The CVSS score of 3.7 reflects a low‑to‑moderate risk, indicating the flaw is not trivial but could become serious in environments where administrator sessions are not tightly controlled.

The affected product is HCL Aftermarket DPC version 1.0.0. No other vendors or versions are listed in the data.

With a CVSS score of 3.7 and an unavailable EPSS value, the exploitation likelihood is not high, but the attack may still succeed if an attacker can initiate or manage concurrent sessions. Once successful, the attacker attains full administrator permissions, potentially compromising confidentiality, integrity, and availability of the entire system. The vulnerability is not listed in the CISA KEV catalog, so no known public exploits are documented yet, but the potential impact warrants vigilance.