CVE-2024-8773: SIMPLE.ERP Information Disclosure Flaw

CVE-2024-8773 Overview

CVE-2024-8773 affects the SIMPLE.ERP client, which accepts a Microsoft SQL Server protocol downgrade request initiated by the server. The client honors a server-side instruction to negotiate communication without Transport Layer Security (TLS), exposing the session to interception and modification. An attacker positioned between the client and the database server can force unencrypted traffic and read or alter ERP data in transit. The flaw is classified under CWE-757 (Selection of Less-Secure Algorithm During Negotiation). SIMPLE.ERP versions 6.20 through 6.30 are affected, and only version 6.30 received a patch.

Critical Impact
A network-positioned attacker can downgrade SIMPLE.ERP client-to-SQL Server sessions to cleartext, enabling interception and modification of business-critical ERP data.

Affected Products

SIMPLE.ERP 6.20 (unpatched)
SIMPLE.ERP 6.25 (unpatched)
SIMPLE.ERP 6.30 (patched in 6.30@a03.9)

Discovery Timeline

2025-03-24 - CVE-2024-8773 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8773

Vulnerability Analysis

The SIMPLE.ERP client communicates with a Microsoft SQL Server backend using the Tabular Data Stream (TDS) protocol. During the TDS pre-login handshake, the client and server negotiate whether the session will use TLS encryption. The client trusts the server's encryption preference and accepts a downgrade to unencrypted communication when the server indicates encryption is not required.

This trust-the-server design means an attacker who controls the network path or impersonates the SQL Server endpoint can advertise no-encryption support during the pre-login exchange. The client then transmits authentication credentials and subsequent query traffic in cleartext. Sensitive ERP records, including financial data, personal information, and SQL statements, become readable and modifiable on the wire.

The issue maps to CWE-757, where an application selects a weaker cryptographic option during protocol negotiation. Additional analysis is available in the CERT Polska CVE-2024-8773 advisory.

Root Cause

The client does not enforce mandatory TLS on outbound SQL connections. It defers the encryption decision to the server response during the TDS pre-login negotiation, with no client-side policy to reject a no-encryption result.

Attack Vector

An adversary on the same network segment, or one capable of redirecting traffic through ARP spoofing, DNS poisoning, or rogue Wi-Fi, intercepts the TDS handshake. The attacker responds with pre-login flags signaling that encryption is not supported. The SIMPLE.ERP client proceeds in cleartext, allowing passive capture of credentials and queries or active modification of result sets. No authentication or user interaction is required to trigger the downgrade.

Detection Methods for CVE-2024-8773

Indicators of Compromise

Unencrypted TDS traffic on TCP port 1433 (or configured SQL Server port) originating from SIMPLE.ERP client hosts.
TDS pre-login responses from the database server advertising ENCRYPT_NOT_SUP (0x02) when policy requires encryption.
Unexpected ARP table changes or DNS responses on subnets hosting ERP workstations and SQL Servers.

Detection Strategies

Inspect network captures between ERP clients and SQL Servers for cleartext SQL statements and credential exchanges in the TDS stream.
Alert on SIMPLE.ERP client processes establishing SQL sessions that do not transition into a TLS record layer after the pre-login phase.
Correlate endpoint process telemetry for the SIMPLE.ERP client with network flow metadata to flag sessions that bypass encryption policy.

Monitoring Recommendations

Enable SQL Server audit logging for encrypt_option on incoming connections and alert when ERP clients connect without encryption.
Monitor for layer 2 anomalies such as ARP cache poisoning and rogue DHCP activity on segments carrying ERP traffic.
Track installed SIMPLE.ERP client versions across endpoints to identify hosts still running 6.20 or 6.25.

How to Mitigate CVE-2024-8773

Immediate Actions Required

Upgrade all SIMPLE.ERP 6.30 deployments to patch 6.30@a03.9 and enable the administrator setting that enforces encrypted communication.
Plan migration off SIMPLE.ERP 6.20 and 6.25, which remain unpatched, to a supported and patched release.
Configure Microsoft SQL Server to require encryption (Force Encryption = Yes) so the server refuses cleartext sessions regardless of client behavior.
Restrict SQL Server access to trusted network segments using firewall rules and network segmentation.

Patch Information

The vendor released patch 6.30@a03.9 for SIMPLE.ERP 6.30, which introduces an administrator-controlled option to enforce encrypted communication with the SQL Server backend. Versions 6.20 and 6.25 do not have a patch. Refer to the CERT Polska advisory and the SIMPLE.ERP product page for vendor contact and upgrade guidance.

Workarounds

Enforce TLS at the SQL Server side by enabling Force Encryption and deploying a valid server certificate trusted by clients.
Tunnel SIMPLE.ERP client to SQL Server traffic through an IPsec or VPN connection to provide transport-layer confidentiality.
Isolate ERP clients and database servers on a dedicated VLAN with strict access control to limit attacker positioning.

bash

# Configuration example: enforce server-side TLS in SQL Server
# (Set via SQL Server Configuration Manager → Protocols → Properties → Flags)
ForceEncryption = Yes
Certificate = <fully-qualified-server-certificate>

# Verify the encrypt option negotiated on active sessions
SELECT session_id, encrypt_option, auth_scheme, client_net_address
FROM sys.dm_exec_connections;