CVE-2025-42929 Overview
CVE-2025-42929 is a missing input validation vulnerability affecting SAP ABAP reports. An attacker with high-privilege access can delete the contents of arbitrary database tables when those tables are not protected by an authorization group. The flaw impacts the integrity and availability of the underlying database while leaving confidentiality intact. SAP addressed the issue through SAP Security Patch Day and published remediation guidance in SAP Note #3633002. The vulnerability is tracked under [CWE-1287] (Improper Validation of Specified Type of Input).
Critical Impact
Authenticated attackers on an adjacent network can wipe arbitrary unprotected database tables, causing data loss and disruption of dependent SAP business processes.
Affected Products
- SAP NetWeaver ABAP-based platforms exposing the affected ABAP reports
- Database tables lacking authorization group protection in the ABAP dictionary
- Refer to SAP Note #3633002 for the definitive list of impacted components and versions
Discovery Timeline
- 2025-09-09 - CVE-2025-42929 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-42929
Vulnerability Analysis
The vulnerability stems from missing input validation in ABAP reports that accept table names or table-related parameters. An attacker with high-privilege access can supply arbitrary table identifiers that the affected reports do not sanitize or authorize. The report then performs deletion operations against the specified table without verifying that the caller holds the appropriate authorization for that specific object.
SAP protects sensitive tables through authorization groups defined in the TDDAT dictionary. Tables that lack an assigned authorization group inherit no additional access control checks at the report layer. This design gap allows the affected ABAP reports to delete content from any unprotected table the executing user technically has database access to.
The attack is scoped to the adjacent network, requires no user interaction, and produces high integrity and availability impact with a scope change. Confidentiality is not affected because the operation is destructive rather than disclosive. The EPSS probability is 0.232%.
Root Cause
The root cause is improper validation of the specified table input parameter combined with reliance on authorization groups that may not be configured for every business or custom table. Without a mandatory authorization check tied to the target table, the report processes deletion commands against attacker-chosen objects.
Attack Vector
An authenticated attacker with high privileges within the SAP system executes an affected ABAP report and supplies the name of a target table. The report proceeds to delete the table contents without verifying an authorization group. Exploitation requires network adjacency to the SAP application server and existing privileged access to run ABAP reports.
No public proof-of-concept code is available. See SAP Note #3633002 for the vendor's technical description.
Detection Methods for CVE-2025-42929
Indicators of Compromise
- Unexpected mass DELETE operations or empty tables in SAP transports and change documents
- ABAP report executions referencing unusual or business-critical table names in STAD and SM20 audit logs
- Sudden absence of records in tables lacking an authorization group in TDDAT
Detection Strategies
- Enable the SAP Security Audit Log (SM19/RSAU_CONFIG) to capture report starts and dynamic table access events
- Correlate ABAP report execution events with subsequent database row-count anomalies
- Review change document logs and table logging (rec/client parameter) for high-value tables
Monitoring Recommendations
- Forward SAP audit logs to a centralized SIEM and alert on report execution combined with table modification patterns
- Monitor privileged user activity, especially accounts authorized to run generic ABAP reports
- Track TDDAT configuration to identify tables that remain without an authorization group assignment
How to Mitigate CVE-2025-42929
Immediate Actions Required
- Apply the SAP-supplied patch referenced in SAP Note #3633002 as documented on SAP Security Patch Day
- Review and restrict high-privilege authorizations that allow arbitrary ABAP report execution such as S_DEVELOP and S_PROGRAM
- Assign authorization groups in TDDAT to all sensitive custom and business tables
Patch Information
SAP released a fix as part of SAP Security Patch Day. Customers must download and apply the correction described in SAP Note #3633002. The patch enforces proper input validation and authorization checks within the affected ABAP reports.
Workarounds
- Restrict access to affected ABAP reports through S_PROGRAM authorization objects until patching is complete
- Add authorization groups to unprotected database tables to force S_TABU_DIS or S_TABU_NAM checks
- Enable table change logging for critical tables to enable rapid detection and recovery
# Example: verify tables lacking authorization group protection in ABAP
# Run via SE16 or a custom report against TDDAT
SELECT tabname FROM tddat WHERE cclass = '' OR cclass = '&NC&'.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
