PT-2025-12569 · Unknown · Simple.Erp

Published 2025-03-24 · Updated 2025-03-27 · CVE-2024-8773

Positive Technologies (AI Summary)

CVSS v4.0

8.3

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions SIMPLE.ERP versions 6.20 through 6.30 (excluding 6.30 with patch 6.30@a03.9)

Description The issue affects the SIMPLE.ERP client, making it vulnerable to MS SQL protocol downgrade requests from the server side. This could lead to unencrypted communication, which is vulnerable to data interception and modification.

Recommendations For versions 6.20 and 6.25, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For version 6.30, apply patch 6.30@a03.9 to enable the administrator to enforce encrypted communication.

Weakness Enumeration

CWE-757

Related Identifiers

CVE-2024-8773

Affected Products

Simple.Erp

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2024-8773 · Security Note
• https://twitter.com/VulmonFeeds/status/1904166786968224201 · Twitter Post
• https://simple.com.pl/produkty/simple-erp/dla-kogo · Note
• https://t.me/cvenotify/116547 · Telegram Post
• https://twitter.com/CveFindCom/status/1904156758207316003 · Twitter Post
• https://twitter.com/WolfgangSesin/status/1904165785418752041 · Twitter Post
• https://t.me/cvetracker/19755 · Telegram Post
• https://t.me/cvenotify/116548 · Telegram Post
• https://twitter.com/CVEnew/status/1904157315550388510 · Twitter Post
• https://cert.pl/en/posts/2025/03/CVE-2024-8773 · Note
• https://cert.pl/posts/2025/03/CVE-2024-8773 · Note