PT-2025-28276 · Sap · Sap Netweaver System Configuration

Published 2025-07-07 · Updated 2025-07-22 · CVE-2025-42953

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions: SAP Netweaver System Configuration (affected versions not specified)

Description: The issue results from a lack of necessary authorization checks for an authenticated user, leading to escalation of privileges. This could completely compromise the integrity and availability of the system, with no impact on confidentiality.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2025-10642

CVE-2025-42953

Affected Products

Sap Netweaver System Configuration

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-42953 · Security Note
• https://bdu.fstec.ru/vul/2025-10642 · Security Note
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news/july-2025.html · Note
• https://twitter.com/CVEnew/status/1942418301629448236 · Twitter Post
• https://twitter.com/jmdevlabs/status/1947773844002902031 · Twitter Post
• https://twitter.com/cracbot/status/1944351135697117427 · Twitter Post
• https://url.sap/sapsecuritypatchday · Note
• https://me.sap.com/notes/3623440 · Note