CVE-2025-42875
Missing Authentication check in SAP NetWeaver Internet Communication Framework
Vexday Risk Score
13Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 6.6EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
09 Dec 2025Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
The SAP Internet Communication Framework does not conduct any authentication checks for features that need user identification allowing an attacker to reuse authorization tokens, violating secure authentication practices causing low impact on Confidentiality, Integrity and Availability of the application.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
Affected products
SAP_SE · SAP NetWeaver Internet Communication FrameworkWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →