Infor SyteLine ERP stores user passwords, database connection strings, and API keys encrypted with a hard‑coded static cryptographic key that is identical across all installations. Because the same key is used everywhere, an attacker who can read the application binary and the database can decrypt all this sensitive data and gain unauthorized access to system accounts and external services. This flaw is a classic example of improper use of cryptographic keys (CWE‑321 and CWE‑798) and poses a serious confidentiality risk.

The vulnerable product is Infor SyteLine ERP, version 10.0.8803.16889. Any deployment that uses this default key configuration for credential encryption is affected.

The CVSS score of 7.1 indicates a medium‑to‑high impact, and the EPSS score of less than 1% suggests that exploitation is not yet common but feasible for an attacker with the right access. The vulnerability is not listed in the CISA KEV catalog, but if the application binary or database becomes exposed, an attacker can realistically recover all passwords and credential secrets. The likely attack vector is an insider or compromised administrator who can read the binary and database files.