PT-2025-32610 · Sap · Sap Landscape Transformation

Published 2025-08-12 · Updated 2025-09-13 · CVE-2025-42950

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: SAP Landscape Transformation (SLT) (affected versions not specified)

Description: SAP Landscape Transformation (SLT) allows an attacker with user privileges to exploit a flaw in a function module exposed via Remote Function Call (RFC). This enables the injection of arbitrary ABAP code into the system, bypassing essential authorization checks. This functions as a backdoor, potentially leading to full system compromise and undermining the confidentiality, integrity, and availability of the system.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2025-10536

CVE-2025-42950

Affected Products

Sap Landscape Transformation

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2025-42950 · Security Note
• https://bdu.fstec.ru/vul/2025-10536 · Security Note
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news/august-2025.html · Note
• https://twitter.com/CVEnew/status/1955101084873105502 · Twitter Post
• https://twitter.com/CveFindCom/status/1955097504359325931 · Twitter Post
• https://twitter.com/cracbot/status/1957034711483650070 · Twitter Post
• https://twitter.com/f8sbrightermind/status/1955136591602606357 · Twitter Post
• https://twitter.com/TweetThreatNews/status/1955268274180014305 · Twitter Post
• https://url.sap/sapsecuritypatchday · Note
• https://t.me/CVEtracker/29736 · Telegram Post
• https://me.sap.com/notes/3633838 · Note
• https://twitter.com/IamTaradutt/status/1966871808805892226 · Twitter Post