How Sparrow IT Solutions Helped Uncover a Serious Municipal Software Vulnerability

Cybersecurity threats don’t always come from headline-making ransomware attacks or international hackers. Sometimes, risks exist quietly inside the very software municipalities rely on every day.

That’s exactly what James Harrold at Sparrow IT Solutions LLC discovered while assisting a town hall client we provide managed IT services for. Through a responsible disclosure process, a security vulnerability was patched before it could become widely known.

During a recent server installation and security audit, we identified critical flaws in a widely used municipal accounting system. This was documented in an international database for responsible vulnerability disclosure. The vulnerability notes can be found here. (CVE-2025-9037 and CVE-2025-9040).

This case highlights both the hidden dangers municipalities face and the value of having a vigilant Managed Service Provider (MSP) like Sparrow IT Solutions to help safeguard sensitive information.

The Software Vulnerability We Discovered

In this municipal accounting software were design flaws that could put financial and personal data at risk.

Two key vulnerabilities stood out to James when working with our client. These included:

1. Insecure Credential storage (CVE-2025-9037): Database credentials were not difficult to find for anyone who has some IT knowledge. Attackers might specifically look for something like this.
   

2. Unauthenticated Backup Functionality (CVE-2025-9040): Database backups were able to be completed without logging in or providing user credentials. It seems innocuous, but an attacker would be able to exploit this easily.

Both issues meant that an attacker, whether through malware, physical access, or social engineering, could obtain permanent access (even a copy for themselves) to full municipal databases without needing a password.

The potential consequences? Stolen Personal Identifiable Information (PII), compromised financial records, and disrupted municipal operations. Given the municipality we have as our client, this could have been disastrous.

Why This Matters for Other Municipalities

Many smaller municipalities often operate under tight budgets, with limited or no in-house IT staff. Unfortunately, that makes them a prime target for cybercriminals.

Software flaws like those we uncovered can go unnoticed for years, creating silent risks that could cost towns and cities far more than they realize.

The software vulnerabilities we found demonstrate just how fragile municipal systems can be without proactive oversight. Sensitive financial records, audit trails, and personal data for residents could have been exposed, all stemming from a vulnerability hiding in plain sight.

The Value of Managed IT Services

This discovery underscores the importance of partnering with a trusted Managed Service Provider like Sparrow IT Solutions LLC. Unlike a full IT department, which many municipalities cannot afford, we provide:

• Continuous Monitoring: We actively manage software and hardware, identifying issues before they become crises.

  
  

• Affordable Expertise: Our services cost a fraction of maintaining an in-house IT staff, while still delivering enterprise-grade support.

• Cybersecurity Vigilance: We stay current with the latest security standards and techniques to protect sensitive municipal data.

• Hands-On Problem Solving: As this case shows, we don’t just maintain systems—we uncover risks that others may overlook.

How Municipalities Can Stay Protected

As with most recommendations after vulnerability discovery, updating to the latest official version is recommended.

But updating software is only part of the equation. True protection comes from ongoing vigilance: monitoring for vulnerabilities, securing configurations, and ensuring staff are trained to avoid phishing and social engineering attempts.

This is where Sparrow IT Solutions plays a vital role as a trusted partner. We help both municipalities and our many other clients maintain compliance, protect data, and keep operations running smoothly.

Never Leave Anything to Chance

The vulnerabilities we uncovered were serious, but they also serve as a reminder: cybersecurity is not a “set it and forget it” process. It requires constant attention, expertise, and proactive management.

At Sparrow IT Solutions LLC, we are proud to stand by municipalities and provide the protection, insight, and affordability they need in an increasingly complex digital world. By working with us, towns and cities can focus on serving their residents while we focus on keeping their systems secure.

Security is not optional. We take it very seriously and it's at the forefront of the solutions we implement and at the heart of every action we take.

If you represent a municipality and want to learn more about how Sparrow IT Solutions can safeguard your operations, contact us today. Together, we can build a safer, more resilient foundation for your community.