PT-2025-32605 · Sap · Sap Gui For Windows

Published 2025-08-12 · Updated 2025-08-12 · CVE-2025-42943

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions: SAP GUI for Windows (affected versions not specified)

Description: SAP GUI for Windows may allow the leak of NTML hashes when specific ABAP frontend services are called with UNC paths. A successful attack requires developer authorization in a specific Application Server ABAP to make code changes, and the victim must execute the process using SAP GUI for Windows. This could trigger automatic NTLM authentication, potentially exposing hashed credentials to an attacker, resulting in a high impact on confidentiality.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-250

Related Identifiers

BDU:2025-16190

CVE-2025-42943

Affected Products

Sap Gui For Windows

References · 7

• https://bdu.fstec.ru/vul/2025-16190 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-42943 · Security Note
• https://twitter.com/CVEnew/status/1955101089151238628 · Twitter Post
• https://url.sap/sapsecuritypatchday · Note
• https://t.me/CVEtracker/29731 · Telegram Post
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news/august-2025.html · Note
• https://me.sap.com/notes/3627845 · Note