CVE-2025-42957

Published Aug 12, 2025

Last updated 3 months ago

SAP S/4HANA

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-42957 is a code injection vulnerability affecting SAP S/4HANA, specifically its function module exposed via RFC. It allows an attacker with user privileges to inject arbitrary ABAP code into the system, bypassing authorization checks. This vulnerability can be exploited by an authenticated attacker with valid SAP credentials and S_RFC authorizations by invoking a vulnerable function module and supplying crafted input that is directly used in dynamic ABAP code execution constructs. Successful exploitation of CVE-2025-42957 can lead to a complete system compromise, undermining the confidentiality, integrity, and availability of the system. This includes the potential to modify the SAP database, create superuser accounts, download password hashes, and alter business processes. SecurityBridge has verified that the exploit is being used in the wild.

Description: SAP S/4HANA allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code into the system, bypassing essential authorization checks. This vulnerability effectively functions as a backdoor, creating the risk of full system compromise, undermining the confidentiality, integrity and availability of the system.
Source: cna@sap.com
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.9
Impact score: 6
Exploitability score: 3.1
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

cna@sap.com: CWE-94

Hype score: Not currently trending

References