# CVE-2025-10609: Logo Software TigerWings ERP hard-coded credentials

Source: https://junglewise.ai/threats/cve-2025-10609-logo-software-tigerwings-erp-hard-coded-credentials  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-10-03. Updated: 2026-06-05  
License: CC BY 4.0 with a link back

CVE-2025-10609 · Severity: medium · CVSS 5.9 · Published 2025-10-03

Logo Software Inc. TigerWings ERP, a business management software suite, contains a security flaw where sensitive login information or encryption keys are permanently written into the software's code. An individual with physical access to the system could extract these secrets to bypass security controls or tamper with the application's integrity. This could lead to unauthorized changes in business data or a disruption of ERP services.

Vendors: [Logo Software](https://junglewise.ai/threats/vendors/logo-software).

## Quick answers

**Is CVE-2025-10609 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-10609 being exploited in the wild.

**How severe is CVE-2025-10609?** Medium severity, with a CVSS score of 5.9, published 3 October 2025.

**Which products and versions are affected?** Logo Software TigerWings ERP 01.01.00 to 3.03.00.

**Is there a fix for CVE-2025-10609?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-10609 attacked?** It is attacked with physical access, in a network appliance.

**Am I affected by CVE-2025-10609?** Check whether you run Logo Software TigerWings ERP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Use of Hard-coded Credentials vulnerability (CWE-798) exists in Logo Software Inc. TigerWings ERP versions 01.01.00 through 3.03.00. The vulnerability stems from sensitive constants, such as credentials or cryptographic keys, being embedded directly within the application's executable files. An attacker with physical access and low-level user privileges can read these constants from the binary. According to the CVSS vector, this can be leveraged to impact the integrity of the system. Users are advised to update to version 3.03.00 or later to mitigate this risk.

## Affected products

- Logo Software Inc. TigerWings ERP 01.01.00 to 3.03.00

## Timeline

- 2025-10-03: disclosed
- 2025-10-03: advisory

## References

- [https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0313](https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0313)
- [https://www.usom.gov.tr/bildirim/tr-25-0313](https://www.usom.gov.tr/bildirim/tr-25-0313)