Code Injection kwetsbaarheid in SAP S/4HANA (Private Cloud of On-Premise)

The impact of CVE-2025-42957 is severe. An attacker who successfully exploits this vulnerability gains the ability to execute arbitrary ABAP code within the SAP S/4HANA system. This effectively creates a backdoor, granting them complete control over the system's functionality. They can potentially access sensitive data, modify critical business processes, and even delete or corrupt data. The ability to bypass authorization checks means that even users with limited privileges could potentially escalate their access and compromise the entire system. This vulnerability shares similarities with other code injection flaws that have led to significant data breaches and operational disruptions in enterprise environments.

Organizations running SAP S/4HANA 102 are at significant risk. Specifically, deployments with overly permissive RFC access controls or those lacking robust input validation are particularly vulnerable. Shared hosting environments utilizing SAP S/4HANA also face increased risk due to the potential for cross-tenant exploitation.

• linux / server:

journalctl -u saprouter -f | grep -i "rfc"

• generic web:

curl -I <rfc_endpoint> | grep -i "SAP S/4HANA"

1. 2025-08-12Disclosure

   disclosure

2. 2025-08-12Patch

   patch

1. Gereserveerd2025-04-16
2. Gepubliceerd2025-08-12
3. Gewijzigd2026-02-26
4. EPSS bijgewerkt2026-03-23

The primary mitigation for CVE-2025-42957 is to upgrade to a patched version of SAP S/4HANA as soon as it becomes available. Until the upgrade can be performed, consider implementing temporary workarounds. Restrict access to the vulnerable RFC function module, limiting it to only authorized users and systems. Implement strict input validation on any data passed to the function module to prevent malicious code injection. Monitor system logs for suspicious activity, particularly attempts to access or execute the vulnerable function module. After applying the upgrade, verify the fix by attempting to trigger the vulnerability using known attack vectors and confirming that the authorization checks are properly enforced.