CVE-2025-42947: SAP FICA ODN Framework RCE Vulnerability

CVE-2025-42947 Overview

CVE-2025-42947 is a code injection vulnerability [CWE-94] in the SAP Financial Contract Accounting (FICA) Official Document Numbering (ODN) framework. A high-privileged authenticated user can inject values into a local variable that the application subsequently executes. Successful exploitation lets an attacker control application behavior, altering integrity of processed data and causing limited availability impact. Confidentiality of the application is not affected.

Critical Impact
An authenticated attacker with high privileges can manipulate application flow through injected values, compromising the integrity of SAP FICA financial document processing.

Affected Products

SAP FICA (Financial Contract Accounting) ODN framework
Refer to SAP Note #3540688 for the complete list of affected component versions
SAP Security Patch Day advisory contains additional product mapping

Discovery Timeline

2025-07-23 - CVE-2025-42947 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-42947

Vulnerability Analysis

The vulnerability resides in the SAP FICA ODN framework, which generates and manages official document numbers for financial contract accounting. The framework accepts input that is written into a local variable and later interpreted by the application at runtime. Because the input is not properly validated or sanitized before execution, an authenticated user with high privileges can inject code constructs that the application evaluates.

Exploitation requires network access to the SAP application and prior authentication with elevated privileges. No user interaction is required. The primary impact is on integrity: an attacker can alter processing logic, modify document numbering, or influence financial records. Availability can be degraded to a limited extent, while confidentiality of application data is not affected.

This class of flaw, classified under [CWE-94] Improper Control of Generation of Code, is dangerous in enterprise resource planning environments because SAP FICA processes financial transactions where integrity is a compliance requirement.

Root Cause

The ODN framework fails to enforce strict validation on values assigned to a local variable that is subsequently evaluated as code. The design assumes that a high-privileged user is trusted, so the input path lacks output encoding, allow-listing, or sandboxing. Any privileged account, including one obtained through credential theft or insider misuse, can abuse this trust boundary.

Attack Vector

The attacker authenticates to the SAP system with a high-privileged account, then submits crafted input to the FICA ODN function that stores and later executes the variable value. When the application processes the affected code path, the injected content runs within the SAP application context and can influence downstream financial document logic. See SAP Note #3540688 for the vendor's technical breakdown.

No public proof-of-concept exploit is available, and CVE-2025-42947 is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-42947

Indicators of Compromise

Unexpected modifications to Official Document Numbering configuration or number range objects in SAP FICA
FICA transactions executed by privileged accounts outside normal business hours or maintenance windows
SAP audit log (SM19/SM20) entries showing anomalous parameter values passed to ODN framework function modules
Discrepancies between generated document numbers and expected sequential numbering

Detection Strategies

Enable SAP Security Audit Log for all privileged users interacting with FICA modules
Correlate changes to ODN customizing tables with authorized change requests through the SAP transport system
Monitor RFC and dialog calls to FICA function modules referenced in SAP Note #3540688
Baseline normal ODN transaction volumes and alert on statistical deviations

Monitoring Recommendations

Forward SAP application, audit, and system logs to a centralized SIEM for correlation
Track privileged role assignments (SAP_ALL, FICA-specific composite roles) and flag additions
Alert on execution of debug or ABAP editor transactions (SE38, SE80, SA38) by FICA operators
Review segregation-of-duties conflicts that grant both financial posting and configuration authority

How to Mitigate CVE-2025-42947

Immediate Actions Required

Apply the SAP patch referenced in SAP Note #3540688 as prioritized in the SAP Security Patch Day release
Audit accounts holding high-privilege FICA authorizations and revoke access that is not business-justified
Review recent ODN framework activity for signs of unauthorized configuration changes
Enforce multi-factor authentication for administrative SAP access

Patch Information

SAP addressed CVE-2025-42947 through the security note published on SAP Security Patch Day. Administrators must download and implement SAP Note #3540688 using SNOTE or the SAP Support Portal. Verify the note's applicability to your installed FICA support package level before deployment, and test in a non-production system.

Workarounds

Restrict authorization objects governing FICA ODN configuration to a minimal set of named administrators
Implement change-control approval for any modification to ODN number range or customizing tables
Disable or tightly monitor debug authorizations (S_DEVELOP with activity 02) in production systems
Segregate configuration duties from transaction posting duties to reduce blast radius of a compromised account

bash

# Configuration example: extract privileged FICA users for review via SAP transaction SUIM
# Run in SAP GUI or via RFC:
#   Transaction: SUIM
#   Path: User -> By Complex Selection Criteria -> By Authorization Values
#   Authorization object: F_KKBA_APP (FICA application authorization)
#   Activity: 02 (Change), 07 (Activate)
# Export the result set and reconcile against approved role assignments.