CVE-2025-42911: SAP Basis Information Disclosure Vulnerability

CVE-2025-42911 Overview

CVE-2025-42911 affects SAP NetWeaver Service Data Download. An authenticated user can call a remote-enabled function module to retrieve information about the SAP system and underlying operating system. The flaw is classified as a missing authorization check [CWE-862] and produces a confidentiality impact without affecting integrity or availability.

SAP addressed the issue in the September 2025 Security Patch Day release documented in SAP Note #3627644. The vulnerability affects a broad range of SAP_BASIS versions, from 7.00 through 8.16, making it relevant to many production SAP landscapes.

Critical Impact
An authenticated SAP user with low privileges can invoke a remote-enabled function module (RFM) over the network to disclose SAP system and operating system details that aid reconnaissance for follow-on attacks.

Affected Products

SAP_BASIS 7.00, 7.01, 7.02, 7.31, 7.40
SAP_BASIS 7.50 through 7.58
SAP_BASIS 8.16

Discovery Timeline

2025-09-09 - CVE-2025-42911 published to NVD alongside SAP Security Patch Day
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-42911

Vulnerability Analysis

The vulnerability resides in the Service Data Download component of SAP NetWeaver Application Server ABAP. The component exposes one or more remote-enabled function modules that fail to enforce a sufficient authorization check before returning system data. Any authenticated principal with Remote Function Call (RFC) access can call the affected RFM and receive details about the SAP installation and the host operating system.

Disclosed data of this type typically supports attacker reconnaissance. Kernel release, patch level, host name, operating system version, and installed component information help adversaries select follow-on exploits and tailor privilege escalation attempts within the SAP landscape.

The weakness is tracked under CWE-862: Missing Authorization. The function module performs its work without validating that the caller holds the authorization object required for Service Data Download operations.

Root Cause

SAP exposes administrative diagnostic functions through RFC-enabled modules in SAP_BASIS. The affected module omits a AUTHORITY-CHECK statement for the authorization object that would normally restrict Service Data Download usage to administrative roles. Authentication alone is insufficient here, since standard business users should not be able to read SAP or OS infrastructure metadata.

Attack Vector

Exploitation requires valid SAP credentials and network reach to the application server's RFC gateway (typically TCP 33xx) or to a SOAP/RFC endpoint that proxies the call. An attacker authenticates as a low-privilege dialog or communication user, then invokes the vulnerable RFM using an RFC client such as sapnwrfc, SAP GUI function builder (SE37), or a custom RFC consumer. The server returns the system and OS information in the response payload. No user interaction is required.

See SAP Note #3627644 for the authoritative technical description and the list of patched Support Package levels.

Detection Methods for CVE-2025-42911

Indicators of Compromise

RFC calls from unexpected users or source hosts to the Service Data Download function module in SAP_BASIS.
STAD or SM20 audit log entries showing low-privilege users invoking administrative RFMs tied to service data collection.
Spikes in RFC traffic to the application server gateway from accounts that normally only perform dialog activity.

Detection Strategies

Enable the SAP Security Audit Log (SM19/RSAU_CONFIG) with RFC call auditing for critical function groups, and alert on calls from non-administrative users.
Review Gateway logs (gw/logging) for RFC server invocations against the affected modules, and baseline normal callers.
Correlate RFC telemetry with SIEM data to identify authenticated enumeration patterns targeting multiple RFMs in short time windows.

Monitoring Recommendations

Forward SAP Security Audit Log, Gateway log, and STAD records to a central SIEM for long-term analysis.
Track per-user RFM call distributions and flag deviations from a role-based baseline.
Monitor service accounts and RFC communication users for calls outside documented integration patterns.

How to Mitigate CVE-2025-42911

Immediate Actions Required

Apply the SAP Security Patch Day update referenced in SAP Note #3627644 to all affected SAP_BASIS systems.
Inventory SAP_BASIS versions across the landscape and prioritize internet-exposed or multi-tenant systems.
Audit RFC authorizations and remove unnecessary S_RFC grants for the affected function group from standard users.

Patch Information

SAP released the fix on the September 2025 Security Patch Day. Administrators should install the Support Package or correction instructions listed in SAP Note #3627644. Patch availability covers SAP_BASIS 7.00 through 8.16. Confirmed patched versions are documented in the note and the SAP Security Patch Day Update.

Workarounds

Restrict access to the affected RFM via S_RFC authorization checks limiting the function group to administrative roles.
Use RFC callback allow-lists and secure network zoning to limit which hosts can reach the SAP RFC gateway.
Rotate credentials for RFC communication users and enforce least privilege on service accounts used for integrations.

bash

# Example SM19/RSAU_CONFIG filter to audit RFC calls by low-privilege users
# (apply through transaction RSAU_CONFIG; values illustrative)
Audit Class       : RFC Function Call
Events            : Successful and Unsuccessful
User Filter       : * (all users, exclude SAP_ADM role via secondary filter)
Function Module   : <affected Service Data Download RFM from SAP Note 3627644>