Full Report
CERT Polska has received a report about 2 vulnerabilities (CVE-2025-68420 and CVE-2025-68421) found in Comarch ERP Optima software.
Analysis Summary
# Vulnerability: Multiple Flaws in Comarch ERP Optima Database Authentication
## CVE Details
- **CVE ID:** CVE-2025-68420
- **CVSS Score:** Not explicitly provided in the source (Estimate: Medium/High)
- **CWE:** CWE-266 (Incorrect Privilege Assignment)
- **CVE ID:** CVE-2025-68421
- **CVSS Score:** Not explicitly provided in the source (Estimate: Critical)
- **CWE:** CWE-798 (Use of Hard-coded Credentials)
## Affected Systems
- **Products:** Comarch ERP Optima
- **Versions:** All versions prior to 2026.4
- **Configurations:** Systems where the client application has been configured (even if no user is currently logged in).
## Vulnerability Description
The software suffers from two distinct authentication and privilege management flaws:
1. **CVE-2025-68420:** The ERP Optima client connects to the backend database using a high-privileged account by default, independent of the specific user account used to log into the application. Because these credentials reside in the client process memory, a local attacker can dump the process memory to extract the database credentials and gain unauthorized administrative access to the database.
2. **CVE-2025-68421:** The software utilizes hard-coded passwords for a database user that cannot be modified by the administrator. This allows an attacker to bypass standard authentication controls.
## Exploitation
- **Status:** PoC availability/Exploitation in the wild not specified; disclosed via Coordinated Vulnerability Disclosure.
- **Complexity:**
- CVE-2025-68420: Medium (Requires local access/process memory dumping).
- CVE-2025-68421: Low (Hard-coded credentials).
- **Attack Vector:**
- CVE-2025-68420: Local.
- CVE-2025-68421: Network (Remote).
## Impact
- **Confidentiality:** High (Full access to ERP database records).
- **Integrity:** High (Modification of financial/resource data; ability to execute system commands on the server via CVE-2025-68421).
- **Availability:** High (Potential for database destruction or system command execution).
## Remediation
### Patches
- **Version 2026.4:** Comarch has released this version to address both vulnerabilities. Users are urged to upgrade to this version (or newer) immediately.
### Workarounds
- No specific software workarounds were provided. It is recommended to restrict network access to the database server (e.g., via firewall) so that only authorized IPs can connect to the database ports, mitigating the risk of CVE-2025-68421.
## Detection
- Monitor for unauthorized database connections originating from unexpected IP addresses or local processes.
- Audit database logs for the use of default or high-privileged service accounts for tasks not associated with standard administrative maintenance.
- Inspect system logs for evidence of process memory dumping (e.g., unauthorized use of `lsass.exe` tools or similar debugging utilities on client workstations).
## References
- CERT Polska Advisory: hxxps[://]cert[.]pl/en/posts/2026/05/vulnerabilities-in-comarch-erp-optima/
- CVE-2025-68420: hxxps[://]www[.]cve[.]org/CVERecord?id=CVE-2025-68420
- CVE-2025-68421: hxxps[://]www[.]cve[.]org/CVERecord?id=CVE-2025-68421