This vulnerability (CVE-2025-10609) in TigerWings ERP is classified under CWE-798, indicating the use of hard-coded credentials. The issue allows reading sensitive constants within the executable, potentially exposing credentials or secrets embedded in the software. The affected versions include TigerWings ERP from 01.01.00 up to but not including 3.03.00. The CVSS 3.1 base score is 5.9 (medium), with attack vector being physical (local), low attack complexity, requiring low privileges, no user interaction, and resulting in no confidentiality impact but high integrity and low availability impacts. There is no indication of known exploits in the wild or vendor-provided patches at this time.

The vulnerability allows an attacker with local access and low privileges to read hard-coded credentials or sensitive constants within the TigerWings ERP executable. While confidentiality is not directly impacted, the integrity of the system can be compromised, potentially allowing unauthorized modification or misuse of the application. Availability impact is low. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit local access to trusted users only and monitor for unauthorized access attempts. Avoid deploying affected versions in untrusted environments.