CVE-2025-42875: SAP ICF Authentication Bypass Vulnerability

CVE-2025-42875 Overview

CVE-2025-42875 affects the SAP Internet Communication Framework (ICF), the HTTP-based communication layer used by SAP NetWeaver Application Server. The framework fails to perform authentication checks on features that require user identification. An authenticated attacker with high privileges can reuse authorization tokens to access functionality that should require independent verification. The flaw is classified under [CWE-306] (Missing Authentication for Critical Function) and impacts confidentiality, integrity, and availability of the application at a low level, with scope change extending the impact beyond the vulnerable component.

Critical Impact
An attacker with valid credentials can reuse authorization tokens to access ICF-exposed functions without re-authentication, violating secure session and identity controls across the SAP application.

Affected Products

SAP Internet Communication Framework (ICF)
SAP NetWeaver Application Server components exposing services through ICF
Refer to SAP Note #3591163 for the complete list of affected component versions

Discovery Timeline

2025-12-09 - CVE-2025-42875 published to the National Vulnerability Database
2025-12-09 - SAP publishes SAP Note #3591163 on SAP Security Patch Day
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-42875

Vulnerability Analysis

The SAP Internet Communication Framework routes inbound HTTP, HTTPS, and SMTP traffic to server-side handlers within the SAP Application Server. Certain handlers require explicit user identification before executing sensitive operations. In vulnerable versions, ICF does not enforce authentication checks on those handlers. As a result, previously issued authorization tokens remain valid for reuse against endpoints that should require independent identity verification.

The scope change indicated in the vector reflects that a compromise in ICF handling can affect resources managed by other components. Confidentiality, integrity, and availability are each rated low, meaning limited data disclosure, partial modification, or partial disruption of application services.

Root Cause

The root cause is a missing authentication control on ICF service handlers that require user identification, mapped to [CWE-306]. The framework accepts and honors authorization tokens without re-validating the caller's identity or session context at the moment of use. This design gap breaks the assumption that each privileged action requires a live authentication decision.

Attack Vector

Exploitation requires network reachability to the SAP ICF endpoints and existing high-privilege credentials or access to a valid token. The attacker replays or reuses an authorization token against an ICF-exposed function that should have triggered a fresh authentication check. No user interaction is required. Because scope is changed, the impact can extend to resources beyond the ICF component itself.

No verified public exploit code is available for CVE-2025-42875 at the time of publication. See SAP Note #3591163 for vendor-provided technical details.

Detection Methods for CVE-2025-42875

Indicators of Compromise

Repeated use of the same authorization token across disparate ICF service paths within short time windows
HTTP requests to sensitive ICF handlers that lack corresponding fresh authentication events in SAP audit logs
Access to privileged ICF endpoints from source IPs or user agents that do not match the token issuer's session origin

Detection Strategies

Correlate SAP Security Audit Log entries with ICF access logs to identify actions performed without a preceding authentication event
Baseline normal token lifetimes and flag reuse patterns that persist beyond expected session boundaries
Alert on high-privilege account activity against ICF services that historically require interactive authentication

Monitoring Recommendations

Forward SAP Web Dispatcher and ICF access logs to a centralized analytics platform for behavioral analysis
Monitor for anomalous token reuse across service handlers, especially administrative or configuration endpoints
Track privileged user sessions for concurrent activity from multiple network locations

How to Mitigate CVE-2025-42875

Immediate Actions Required

Apply the patch referenced in SAP Note #3591163 to all affected SAP systems
Inventory ICF services enabled in each SAP Application Server and disable handlers that are not required for business operations
Rotate credentials and invalidate long-lived authorization tokens for high-privilege accounts following patch deployment

Patch Information

SAP released the corrective note on Security Patch Day. Administrators must download and apply SAP Note #3591163 through the SAP support portal. Consult the SAP Security Patch Day page for the full patch bundle and prerequisite kernel or support package levels.

Workarounds

Restrict network access to ICF endpoints using SAP Web Dispatcher rules or perimeter firewalls until patches are applied
Deactivate unused ICF services through transaction SICF to reduce the attack surface
Enforce shorter token and session lifetimes for privileged users to limit the window for token reuse

bash

# Configuration example: disable an unused ICF service via SAP transaction SICF
# 1. Log in to the SAP GUI with administrative privileges
# 2. Run transaction: SICF
# 3. Locate the service path (for example: /default_host/sap/bc/<service>)
# 4. Right-click the service and select: Deactivate Service
# 5. Confirm deactivation and review changes in the SAP Security Audit Log (transaction SM19/SM20)