PT-2025-36563 · Ibm+1 · Ibm I-Series+1

Published 2025-04-16 · Updated 2025-10-14 · CVE-2025-42958

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver (affected versions not specified)

Description: A missing authentication check in the SAP NetWeaver application on IBM i-series allows unauthorized users with high privileges to read, modify, or delete sensitive information, and access administrative functionalities. This impacts the confidentiality, integrity, and availability of the application.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-250

Related Identifiers

BDU:2025-14335

CVE-2025-42958

Affected Products

Ibm I-Series

Sap Netweaver

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2025-42958 · Security Note
• https://bdu.fstec.ru/vul/2025-14335 · Security Note
• https://me.sap.com/notes/3627373 · Note
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html?anchorId=section_370125364 · Note
• https://t.me/CVEtracker/32035 · Telegram Post
• https://reddit.com/r/pwnhub/comments/1ndzpob/critical_sap_netweaver_flaws_expose_businesses_to · Reddit Post
• https://twitter.com/cracbot/status/1967181599197499801 · Twitter Post
• https://twitter.com/HunterMapping/status/1965612372778680411 · Twitter Post
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news/september-2025.html · Note
• https://twitter.com/spinidg/status/1978075622195826835 · Twitter Post
• https://url.sap/sapsecuritypatchday · Note
• https://twitter.com/CVEnew/status/1965244284631744609 · Twitter Post
• https://twitter.com/ZeroPathLabs/status/1965253147795820778 · Twitter Post
• https://twitter.com/grok/status/1965526146621317458 · Twitter Post