CVE-2025-42885 Overview
CVE-2025-42885 is a missing authentication vulnerability in SAP HANA 2.0, specifically affecting the hdbrss component. The flaw allows an unauthenticated remote attacker to invoke a remote-enabled function that returns internal information. The issue is categorized under [CWE-306] Missing Authentication for Critical Function.
Exploitation requires no privileges and no user interaction. The scope is changed, meaning a successful attack impacts resources beyond the vulnerable component. The impact is limited to confidentiality, with no effect on integrity or availability of the SAP HANA system.
Critical Impact
An unauthenticated network attacker can call a remote-enabled function in SAP HANA hdbrss to disclose information from the database service.
Affected Products
- SAP HANA 2.0 (hdbrss component)
Discovery Timeline
- 2025-11-11 - CVE-2025-42885 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-42885
Vulnerability Analysis
The vulnerability resides in hdbrss, the Remote SQL Service component of SAP HANA 2.0. The service exposes a remote-enabled function that does not enforce authentication before returning data. An attacker with network reachability to the SAP HANA instance can invoke the function directly.
Because the SAP HANA service runs with elevated privileges and can access data belonging to other database tenants or components, the CVSS scope is marked as changed. The disclosed information is confined to what the callable function returns, so confidentiality is impacted at a limited level while integrity and availability remain intact.
The EPSS score is 0.311% with a percentile of 23.46, reflecting a relatively low predicted probability of near-term exploitation.
Root Cause
The root cause is a missing authentication check on a remote-enabled function exposed by hdbrss. The function accepts and processes requests from network callers without validating caller identity or session state, violating the principle of authenticating before serving privileged operations.
Attack Vector
The attack vector is network-based. An attacker who can reach the SAP HANA network port hosting hdbrss sends a crafted request invoking the vulnerable remote-enabled function. No credentials, tokens, or user interaction are required. The function responds with information that would normally require authenticated access. See the SAP Note #3639264 advisory for component-level technical details.
Detection Methods for CVE-2025-42885
Indicators of Compromise
- Unauthenticated inbound connections to SAP HANA hdbrss network endpoints from unexpected sources
- Anomalous invocation patterns of remote-enabled functions in SAP HANA audit logs without a preceding authentication event
- Access to hdbrss from IP ranges outside the documented SAP administration or application server subnets
Detection Strategies
- Enable and review the SAP HANA audit trail for calls to remote-enabled functions, correlating each call with a valid authenticated session
- Baseline normal hdbrss client sources and alert on new or external callers
- Ingest SAP HANA and network telemetry into a centralized analytics platform to correlate function invocations with session context
Monitoring Recommendations
- Monitor SAP HANA process (hdbrss) listeners for connections from non-whitelisted hosts
- Track spikes in remote-enabled function calls without a corresponding logon event
- Alert on outbound data volumes from SAP HANA services that deviate from established baselines
How to Mitigate CVE-2025-42885
Immediate Actions Required
- Apply the SAP security patch referenced in SAP Note #3639264 to affected SAP HANA 2.0 systems
- Review the SAP Security Patch Day bulletin for the applicable patch level and dependencies
- Restrict network access to SAP HANA service ports so that only trusted application servers and administrators can reach hdbrss
- Audit historical logs for unauthenticated calls to remote-enabled functions prior to patching
Patch Information
SAP has released a fix documented in SAP Note #3639264. Customers should follow the SAP Security Patch Day guidance and apply the corresponding SAP HANA 2.0 revision that addresses the missing authentication check in hdbrss.
Workarounds
- Segment SAP HANA management interfaces behind firewalls and permit access only from authorized administration hosts
- Disable or block network exposure of the hdbrss remote-enabled function until the patch is deployed, where operationally feasible
- Enforce mutual TLS or VPN tunnels between application servers and SAP HANA to prevent direct exposure of database service ports
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
