CVE-2025-23187: SAP SDCCN Authorization Bypass Vulnerability

CVE-2025-23187 Overview

CVE-2025-23187 is a missing authorization vulnerability in an SAP transaction SDCCN Remote Function Call (RFC) enabled function module. The flaw allows an unauthenticated network attacker to invoke the function module without the required authorization checks. Successful exploitation lets the attacker generate technical meta-data on the target SAP system. The vulnerability affects integrity at a limited scope and does not impact confidentiality or availability. SAP addressed the issue in the February 2025 Security Patch Day release via SAP Note #3546470. The weakness is categorized under [CWE-862] Missing Authorization.

Critical Impact
Unauthenticated remote attackers can invoke a protected RFC function module in the SDCCN transaction to write technical meta-data, tampering with system state without credentials.

Affected Products

SAP NetWeaver Application Server ABAP (component exposing the SDCCN transaction)
Systems running the Service Data Control Center (SDCCN) with RFC exposure
Refer to SAP Note #3546470 for the authoritative list of impacted Support Package levels

Discovery Timeline

2025-02-11 - CVE-2025-23187 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-23187

Vulnerability Analysis

The vulnerability resides in an RFC-enabled function module reachable through the SDCCN (Service Data Control Center New) transaction in SAP NetWeaver ABAP. The function module accepts inbound RFC calls but does not enforce an authorization check before executing its logic. As a result, callers that reach the SAP Gateway can invoke the module without proving they hold the required authorization objects. The impact is limited to integrity: the attacker can trigger the generation of technical meta-data structures inside the SDCCN framework. Confidentiality and availability are not affected, and no privilege escalation path is documented.

Root Cause

The root cause is a missing AUTHORITY-CHECK statement inside the RFC-exposed function module, mapped to [CWE-862] Missing Authorization. Standard SAP practice requires each RFC function module to validate authorization objects such as S_RFC and function-specific objects before executing business logic. In this module the check was absent, so the ABAP runtime executed the code path for any successfully connected caller.

Attack Vector

An attacker reaches the vulnerable module over the network by connecting to the SAP Gateway and issuing an RFC call to the SDCCN function. Because authentication is not required in this code path, the attacker does not need valid SAP credentials. Once invoked, the function generates technical meta-data records that the attacker would otherwise not be authorized to create. No verified public exploit or proof-of-concept has been released. See the SAP Security Patch Day portal and SAP Note #3546470 for the vendor's technical description.

Detection Methods for CVE-2025-23187

Indicators of Compromise

Unexpected RFC calls to the SDCCN function module originating from unauthenticated or unknown source hosts in SAP Gateway logs
New or anomalous entries in SDCCN technical meta-data tables that do not correspond to scheduled service sessions
RFC traffic to SDCCN outside of documented maintenance windows or from IP ranges not associated with SAP Solution Manager

Detection Strategies

Enable and review SAP Security Audit Log (transaction SM19 / RSAU_CONFIG) for RFC calls to SDCCN function modules and correlate against authorized service users
Enable SAP Gateway logging (gw/logging parameter) to capture inbound RFC connections and identify unauthenticated invocations
Baseline SDCCN meta-data table changes and alert on records created outside of expected service session workflows

Monitoring Recommendations

Forward SAP Security Audit Log, Gateway log, and RFC trace data into a centralized analytics platform for correlation across ABAP systems
Alert on RFC calls to SDCCN modules from source hosts that are not part of the approved SAP Solution Manager landscape
Track SAP Note compliance state via RSECNOTE / System Recommendations to confirm that SAP Note #3546470 remains applied after transports

How to Mitigate CVE-2025-23187

Immediate Actions Required

Apply SAP Note #3546470 to all affected SAP NetWeaver ABAP systems as documented in the February 2025 SAP Security Patch Day
Restrict SAP Gateway access using reginfo and secinfo access control lists so that only trusted hosts can register or call RFC destinations
Review authorizations for SDCCN service users and remove any accounts that no longer require access to the transaction

Patch Information

SAP released the fix on the February 2025 Security Patch Day. The corrective patch is delivered through SAP Note #3546470, which introduces the missing authorization check in the affected RFC function module. Administrators should consult the note for the exact Support Package and kernel prerequisites, then deploy the correction via SNOTE or the appropriate Support Package Stack. Verify successful application using the SAP Security Patch Day landing page and the System Recommendations component in SAP Solution Manager.

Workarounds

Block external network access to the SAP Gateway ports (typically sapgw<instance> 33xx and sapgws<instance> 48xx) at the perimeter firewall
Tighten secinfo and reginfo files to allow RFC calls to the affected module only from authorized SAP Solution Manager hosts
Disable or restrict the SDCCN transaction on systems that do not require outbound service data collection until the patch is applied

bash

# Example SAP Gateway secinfo entry restricting RFC callers to trusted hosts
# File: /usr/sap/<SID>/<instance>/data/secinfo
P TP=* USER=* USER-HOST=solman.internal.example.com HOST=local
D TP=* USER=* USER-HOST=* HOST=*