CVE-2023-4539 is a high severity (CVSS 7.5) hard-coded password flaw in Comarch ERP XL, versions 2020.2.2 through 2023.2. A special database account created at installation uses the same password everywhere. CERT Polska says the vendor fixed it in newer releases, so move to a release the vendor lists as fixed.
What's affected
The NVD record says a hard-coded password for a special database account created during Comarch ERP XL installation lets an attacker retrieve embedded sensitive data stored in the database. The password is the same across all installations. It affects ERP XL from 2020.2.2 through 2023.2.
CERT Polska published the coordinated advisory on 15 February 2024 alongside two related CVEs for the same product, CVE-2023-4537 and CVE-2023-4538. It confirms the same version range and says the vendor confirmed all the issues and fixed them in newer releases. It does not name a single fixed version in the text we read, so get the exact release number from Comarch.
CERT Polska describes the sibling issues as an MS SQL protocol downgrade that could lead to unencrypted traffic, and insufficiently protected credentials where database access credentials are stored encrypted with a key shared across vulnerable installations.
How to check if you're exposed
Check the ERP XL version in the application About dialog or your installation records. Anything from 2020.2.2 through 2023.2 is in scope.
Then identify the database server and who can reach it on the network. A shared password matters most when the database port is reachable from desktops, VPN ranges or other systems that should not talk to it.
Review database logins for the special installation account and note any connections from unusual hosts.
Ask Comarch for the fixed release and the steps that retire the shared credential.
What to do now
- Inventory ERP XL installations and their versions.
- Get the fixed release and upgrade path from Comarch.
- Restrict database network access to the application servers that need it.
- Enable encrypted connections to the database where your setup allows.
- Audit database accounts and logs, and rotate any credentials the vendor tells you to.
Why it matters
The weakness is CWE-798, use of a hard-coded password. Anyone who learns the value once, from a single installation, knows it for every other installation of the same product. A secret that is shared by all customers is not a secret.
The impact here is exposure of data held in the database, which in an ERP system can include business and personal records. The record does not claim exploitation and the CVE is not in the CISA KEV catalog. For builders, the lesson is to generate a unique credential per installation, and to never ship one in code or installers.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Can I fix this by changing the password myself?
Do not assume so. The credential is part of the installation, so follow the vendor guidance in the fixed release.
Sources
Last reviewed: 19 October 2026.
