CVE-2025-42986 in NetWeaver and ABAP Platform
Summary
by MITRE • 07/08/2025
Due to a missing authorization check in an obsolete RFC enabled function module in SAP BASIS, an authenticated low-privileged attacker could call a Remote Function Call (RFC), potentially accessing restricted system information. This results in low impact on confidentiality, with no impact on integrity or availability of the application.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/27/2025
The vulnerability identified as CVE-2025-42986 resides within SAP BASIS component where an obsolete RFC enabled function module lacks proper authorization verification mechanisms. This represents a classic authorization bypass flaw that allows malicious actors with minimal privileges to exploit a legacy system function. The affected function module operates under RFC protocols which are fundamental to SAP's distributed computing architecture, enabling remote procedure calls between different SAP systems and external applications. The vulnerability specifically targets the absence of authorization checks within this deprecated functionality, creating a potential pathway for unauthorized data access.
The technical implementation of this flaw stems from the improper handling of authentication contexts within the obsolete RFC function module. When an authenticated user invokes this function, the system fails to validate whether the requesting user possesses adequate privileges to access the underlying system information. This authorization gap exists because the function module was designed without modern access control enforcement mechanisms, and despite being deprecated, continues to remain active within the system. The RFC interface provides a direct communication channel that bypasses normal authorization enforcement points, allowing attackers to leverage legitimate system interfaces for unauthorized information retrieval.
From an operational impact perspective, the vulnerability manifests as a confidentiality breach with minimal effects on system integrity and availability. Attackers with low-privileged accounts can potentially access restricted system information through this unauthorized RFC call, though the scope of accessible data remains limited to what is exposed by the deprecated function module. The low impact classification reflects that the vulnerability does not enable system compromise, data modification, or service disruption, but rather provides information disclosure capabilities. This aligns with CWE-284 which categorizes the flaw as an "Improper Access Control" vulnerability, specifically targeting authorization mechanisms that fail to properly validate user permissions.
The exploitation of this vulnerability requires an authenticated user context, meaning attackers must first establish a valid login to the SAP system before attempting to leverage this authorization bypass. This authentication requirement significantly limits the attack surface but does not eliminate the risk entirely, as compromised low-privileged accounts could be used to execute this attack. The persistence of this vulnerability in deprecated functionality highlights the ongoing risk posed by legacy system components that remain active despite being outdated. Organizations should consider this vulnerability in the context of ATT&CK technique T1078 which addresses valid accounts and privilege escalation, as the flaw enables unauthorized access through legitimate system interfaces.
Mitigation strategies for CVE-2025-42986 should focus on disabling or removing the obsolete RFC function module from active system configurations. SAP recommends applying the relevant security patches or hotfixes that address the missing authorization check in the affected function module. Organizations should also implement regular inventory reviews to identify and decommission deprecated system components that continue to operate within production environments. Additional controls including network segmentation, limiting RFC access to authorized systems only, and implementing comprehensive monitoring for unusual RFC activity can help reduce the risk exposure. The remediation approach should align with industry best practices for managing legacy system components and maintaining secure system configurations in accordance with ISO 27001 and NIST cybersecurity frameworks.