Vulnerability · Published Mar 24, 2025 · Assigned by CERT-PL

CVE-2024-8773Protocol Downgrade in SIMPLE.ERP

High 8.3

In plain English

A high-severity security flaw in SIMPLE.ERP from Simple SA. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).

Severity (CVSS 4.0)8.3High

Exploit odds (30 days)0.4%top 60.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

SIMPLE.ERP client is vulnerable to MS SQL protocol downgrade request from a server side, what could lead to an unencrypted communication vulnerable to data interception and modification. This issue affect SIMPLE.ERP from 6.20 to 6.30. Only the 6.30 version received a patch 6.30@a03.9, which make it possible for an administrator to enforce encrypted communication. Versions 6.20 and 6.25 remain unpatched.

Affected products (as reported)

Vendor	Product	Versions
Simple SA	SIMPLE.ERP	6.20 – before 6.30@a03.9

Weakness: CWE-757 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

References

https://cert.pl/en/posts/2025/03/CVE-2024-8773/ third-party-advisory
https://cert.pl/posts/2025/03/CVE-2024-8773/ third-party-advisory
https://simple.com.pl/produkty/simple-erp/dla-kogo/ product