PT-2025-15368 · Sap · Sap S/4Hana

Published 2025-04-08 · Updated 2025-04-24 · CVE-2025-27429

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: SAP S/4HANA (affected versions not specified)

Description: The issue allows an attacker with user privileges to exploit a flaw in the function module exposed via RFC, enabling the injection of arbitrary ABAP code into the system and bypassing essential authorization checks. This effectively creates a backdoor, risking full system compromise and undermining the confidentiality, integrity, and availability of the system.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2025-04231

CVE-2025-27429

Affected Products

Sap S/4Hana

References · 17

• https://nvd.nist.gov/vuln/detail/CVE-2025-27429 · Security Note
• https://bdu.fstec.ru/vul/2025-04231 · Security Note
• https://twitter.com/cybercronai/status/1909599770777203133 · Twitter Post
• https://t.me/cvedetector/22425 · Telegram Post
• https://t.me/cvetracker/21090 · Telegram Post
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news/april-2025.html · Note
• https://me.sap.com/notes/3581961 · Note
• https://twitter.com/CVEnew/status/1909528297245180368 · Twitter Post
• https://twitter.com/syedaquib77/status/1909667893324677121 · Twitter Post
• https://twitter.com/CyberWatch_News/status/1910268277621653532 · Twitter Post
• https://twitter.com/CCBalert/status/1910013027782369625 · Twitter Post
• https://twitter.com/transilienceai/status/1911027998075306217 · Twitter Post
• https://twitter.com/cybercronai/status/1909679010151293279 · Twitter Post
• https://reddit.com/r/pwnhub/comments/1juh1j7/sap_issues_critical_security_patches_for_major · Reddit Post
• https://twitter.com/vulns_space/status/1909532078653194486 · Twitter Post