CVE-2025-42880
Last modified
CVE-2025-42880 is a critical-severity vulnerability rated 9.9/10 on the CVSS scale. Due to missing input sanitation, SAP Solution Manager allows an authenticated attacker to insert malicious code when calling a remote-enabled function module. This could provide the attacker with full control of the system hence leading to high impact on confidentiality, integrity and availability of the system.. EPSS estimates a 3.90% chance of exploitation in the next 30 days.
Description
Due to missing input sanitation, SAP Solution Manager allows an authenticated attacker to insert malicious code when calling a remote-enabled function module. This could provide the attacker with full control of the system hence leading to high impact on confidentiality, integrity and availability of the system.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-42880?
How severe is CVE-2025-42880?
How do I fix CVE-2025-42880?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-42874SAP NetWeaver remote service for Xcelsius allows an attacker…7.9
- CVE-2025-42875The SAP Internet Communication Framework does not conduct an…6.6
- CVE-2025-42876Due to a Missing Authorization Check vulnerability in SAP S/…7.1
- CVE-2025-42877SAP Web Dispatcher, Internet Communication Manager (ICM), an…7.5
- CVE-2025-42878SAP Web Dispatcher and ICM may expose internal testing inter…8.2
- CVE-2025-4288A vulnerability classified as critical has been found in PCM…9.8
- CVE-2025-42882Due to a missing authorization check in SAP NetWeaver Applic…4.3
- CVE-2025-42883Migration Workbench (DX Workbench) in SAP NetWeaver Applicat…2.7
- CVE-2025-42884SAP NetWeaver Enterprise Portal allows an unauthenticated at…6.5
- CVE-2025-42885Due to missing authentication, SAP HANA 2.0 (hdbrss) allows …5.8
- CVE-2025-42886Due to a Reflected Cross-Site Scripting (XSS) vulnerability …6.1
- CVE-2025-42887Due to missing input sanitation, SAP Solution Manager allows…9.9
Are you affected by CVE-2025-42880?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST