The vulnerability identified as CVE-2024-23573 in HCL Aftermarket EPC involves susceptibility to the Lucky 13 attack, which targets timing side-channel weaknesses in the implementation of TLS and DTLS protocols. This affects versions of TLS 1.1, 1.2, DTLS 1.0, 1.2, as well as older protocols SSL 3.0 and TLS 1.0. The attack can enable an adversary to perform a man-in-the-middle attack by exploiting cryptographic padding oracle timing differences. The CVSS 3.1 base score is 3.7, reflecting a low severity with network attack vector, high attack complexity, no privileges required, no user interaction, and limited confidentiality impact. No official remediation or patch information is provided, and no known exploits are reported in the wild.

The impact is limited to potential confidentiality loss due to the Lucky 13 timing attack on TLS/DTLS implementations. There is no reported impact on integrity or availability. The vulnerability requires a network attacker with high attack complexity and does not require privileges or user interaction. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official remediation or patch is currently documented, users should monitor HCLSoftware advisories for updates. Mitigations may include disabling affected protocol versions (e.g., TLS 1.0, 1.1, SSL 3.0) if possible and ensuring use of updated cryptographic libraries once patches are available.