CVE-2024-23566 identifies a vulnerability in HCL Aftermarket EPC where the absence of CAPTCHA mechanisms allows brute force and automated attacks. This weakness corresponds to CWE-804 (Guessable CAPTCHA), enabling attackers to potentially enumerate accounts and compromise security. The vulnerability has a CVSS 3.1 base score of 6.5 (medium severity), with network attack vector, low attack complexity, no privileges required, and no user interaction needed. No remediation or patch information is currently available, and no known exploits are reported in the wild.

The lack of CAPTCHA protection allows attackers to perform brute force attacks and automated attempts against the application, potentially leading to account enumeration and unauthorized access attempts. The confidentiality and integrity of user accounts may be partially impacted, but availability is not affected. The medium CVSS score reflects these moderate risks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or mitigation is provided by HCLSoftware, consider implementing additional protective controls such as rate limiting, IP blocking, or external CAPTCHA solutions to reduce the risk of automated attacks.