CVE-2024-8773 Protocol Downgrade in SIMPLE.ERP
Attackers can force unencrypted MS SQL communication in SIMPLE.ERP, enabling data interception and modification.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-8773?
CVE-2024-8773 is a high-severity vulnerability in SIMPLE.ERP, published on 24 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SIMPLE.ERP client is vulnerable to MS SQL protocol downgrade request from a server side, what could lead to an unencrypted communication vulnerable to data interception and modification.
This issue affect SIMPLE.ERP from 6.20 to 6.30. Only the 6.30 version received a patch [email protected], which make it possible for an administrator to enforce encrypted communication. Versions 6.20 and 6.25 remain unpatched.
Weakness: CWE-757
Which versions are affected by CVE-2024-8773?
How do I fix CVE-2024-8773?
No fix has been published for CVE-2024-8773 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-8773 being exploited?
There is no known exploitation of CVE-2024-8773 in the wild and no public exploit code.
Sources
Also known as GHSA-69m8-336v-j57w.