Protocol Downgrade in Wapro ERP Desktop
Priority MEDIUM 49CWE-757Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-922.
Summary
Wapro ERP Desktop is vulnerable to MS SQL protocol downgrade request from a server side, what could lead to an unencrypted communication vulnerable to data interception and modification. This issue affects Wapro ERP Desktop versions before 9.00.0.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00924 60th percentileScored 2026-11-07
Fix Fixed Wapro ERP Desktop (Asseco Business Solutions S.A.): 9.00.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Asseco Business Solutions S.A. | Wapro ERP Desktop | before 9.00.0 | 9.00.0 | Patch available | CNA |
- Wapro ERP Desktop VendorAsseco Business Solutions S.A. Affected before 9.00.0 Fixed in 9.00.0 Patch available CNA
Remediation
- Fix · CNA Wapro ERP Desktop (Asseco Business Solutions S.A.) Fixed in 9.00.0
Timeline
- 2026-10-02 Threatist record created from CVE-2024-4995
- 2026-10-03 Alias added: GHSA-5922-vxrc-h3gf
References
More Asseco Business Solutions S.A. vulnerabilities
- TI-2024-04640 Hardcoded Password in Wapro ERP Desktop CVSS 4.0CRITICAL 9.3
Sources
- CVE-2024-4995 · CVE Program
- CVE-2024-4995 · NVD
- FIRST EPSS
- GHSA-5922-vxrc-h3gf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences