MS SQL Protocol Downgrade Vulnerability in SIMPLE.ERP from SIMPLE

CVE-2024-8773

What is CVE-2024-8773?

The SIMPLE.ERP client is susceptible to a vulnerability that allows a downgrade in the MS SQL protocol when triggered by a server request. This could result in unencrypted communication, making the system vulnerable to potential data interception and modification by malicious actors. The issue affects versions 6.20 to 6.30, with only 6.30 receiving a patch that enables administrators to enforce encrypted communications. Notably, versions 6.20 and 6.25 remain unpatched, leaving them exposed.

References